<![CDATA[One example of digital crime that often occurs is data theft, such as transaction information, and important company data. The thief will delete files to remove traces so that it is necessary to search for and restore data that has been deleted to be used as digital evidence. This activity is usually called digital. forensics. Paid digital forensic applications are sold at quite expensive prices, so one alternative is Autopsy, which is an open source based investigation application that can restore data. This research aims to analyze the performance of the autopsy application in returning 70 files including documents, videos and images as digital evidence based on the crime case scenario of data theft with formatted flash disks. NIST SP 800-86 was chosen as the research method because it has simple stages and is in accordance with the research theme. The stages in this method start from collecting evidence, analyzing the contents of the flash disk with the autopsy application, searching for and returning the found files, to validating the files with hash compare. The analysis report shows that the autopsy application succeeded in returning 81.42% of the data that had been deleted and could be used as evidence based on the crime case scenario that had been created. The files that were successfully returned were 10 DOCX, 10 XLSX, 10 PDF, 6 TXT, 1 MP3, 10 MP4, and 10 PNG.]]>
Copyrights © 2023
