Case Studies
From SleuthKitWiki
Honeynet Challenges
The following were written as "official" reports for challenges from the Honeynet Project and provide examples of how to use TSK and Autopsy.
Scan of the Month #29 - Linux VMWare (September 2003)
Scan of the Month #26 - FAT 12 Floppy - Part 2 (February 2003)
Scan of the Month #24 - FAT 12 Floppy - Part 1 (October 2002)
Scan of the Month #15 - Recover a deleted Linux rootkit (May 2001)
Other
If you have examples of how TSK or Autopsy were used in an investigation, please provide a link here.