Sequence Connector for The Sleuth Kit®

Sequence® is a collection of libraries for
automation of cross-application e-discovery and forensic workflows.

This connector contains Steps that interact with the
Autopsy Console application.

Steps

Step	Description	Result Type
`AutopsyCreateNewCase`	Creates a new Autopsy Case.	`Unit`
`AutopsyAddDataSource`	Add a Data Source to an Autopsy Case.	`Unit`
`AutopsyGenerateReports`	Generate Reports for an Autopsy Case.	`Unit`
`AutopsyListDataSources`	List all Data Sources in an Autopsy Case.	`Unit`

Examples

Create a new Case and add data to it

- AutopsyCreateNewCase
    CaseName: "TestCase"
    CaseBaseDirectory: "C:\\Cases"
    CaseType: AutopsyCaseType.single
    DataSourcePath: "C:\\Data\\loadfile_0001-10001.dat"
    IngestProfileName: ""

This will create a new case in c:\Cases.
The Case name will be 'TestCase' with the current date and time appended to it.

Settings

The TSK Connector requires additional configuration which can be
provided using the settings key in connectors.json.

Supported Settings

Name	Required	Type	Description
AutopsyPath	✔	`string`	The Path the to the Autopsy Executable

Example Settings

"Sequence.Connectors.TSK": {
  "id": "Sequence.Connectors.TSK",
  "enable": true,
  "version": "0.16.0",
  "settings": {
    "AutopsyPath": "C:\\Program Files\\Autopsy-4.19.1\\bin\\autopsy64.exe"
  }
}

Documentation

https://sequence.sh

Download

https://sequence.sh/download

Try SCL and Core

https://sequence.sh/playground

Package Releases

Can be downloaded from the Releases page.

NuGet Packages

Release nuget packages are available from nuget.org.

sequence-sh/TSKConnector