Disk-image forensics TL;DR: Autopsy / Sleuth Kit on dd / E01 images; carve deleted files, parse filesystems, recover history. Stub — to be filled in. What it is TODO Preconditions / where it applies TODO Technique TODO Detection and defence TODO References https://www.sleuthkit.org/autopsy/