So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which Autopsy is installed? I mean basically for loading the image, not because there is some vulnerability in the application itself.

  • 2
    You almost answer the question yourself, the only risk is if there is a vulnerability in the application (but this is not unheard of, at those applications become juicy target to pwn analysts, see Wireshark as an example). – Dillinur Feb 19 '15 at 13:49
  • This is why you should always use a Virtual Machine. – Matthew Peters Feb 19 '15 at 14:11

It's somewhat safe to load on Autopsy, to dissect it using fwextract, lazarus, and with a bunch of forensics tools, but is not safe to execute anything of it nor open any files from it using the default applications.

It's easy to create a bunch of infected pdf files that will exploit your Adobe Reader, or png files, or whatever. Some files can infect your system if you run strings on it.

To be safe, use a VM to explore a infected system. It's easier to maintain, and you can clean up everything if you mess things up.

  • +1, VMs for anything you're unsure about! Easy to create new ones, snapshot and wipe them whenever required. You only make the mistake of doing things on your live system that could cause you problems once... – AlexH Feb 19 '15 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.