Forensic Analysis Workstation Setup: Step-by-Step Build Guide

Why you build a dedicated analysis workstation

Every module in this course has you parse artifacts, run tools, and read evidence. You do that work on a machine built for it, not on your daily driver, and the reason is forensic soundness, not convenience. Analysis tools mount images, extract executables pulled from a compromised host, and write large parsed outputs; you want all of that isolated from your personal environment, snapshotted so you can revert to a known-clean state, and network-controlled so a hostile artifact you extract cannot phone home. This guide builds that workstation once, and you reuse it for the whole course.

This is a build guide, not a lesson. Follow the steps in order. Each step names what to do, the exact command where there is one, and how to confirm it worked before you move on. You do not install everything before you can start: Steps 1 to 5 give you a working workstation with the core toolstack, which is enough for Module 1. Steps 6 to 8 add the rest, and because they are more of the same pattern, they are written as short installs with a verification line each.

The evidence you analyze is provided by the course as scenario context (you will examine KAPE collections and artifacts from Northgate Engineering systems, described in each module). You are building the workstation you analyze that evidence on, not a target to attack.

Step 1 — Build the isolated analysis VM

You want the analysis environment separate from your daily machine and easy to snapshot.

1. In your hypervisor (VMware Workstation, Hyper-V, or VirtualBox all work), create a new VM from a Windows 10 or 11 Pro/Enterprise (64-bit) ISO.
2. Size it for forensic work: 16 GB RAM minimum (32 GB is better once you run memory analysis and Plaso), 250 GB of thin-provisioned disk (evidence sets and Autopsy case databases are large), and back it with an SSD if you can, because parsing large artifacts against a spinning disk is painfully slow.
3. Install Windows, then install your hypervisor's guest tools so the display and clipboard behave.
4. Set the VM's network adapter so it can reach the internet for now (you need it for the tool downloads in the steps below). After the toolstack is installed, you will restrict it. Isolation matters most when you are handling live evidence, and you have none yet.
5. Once Windows is up and updated, take a snapshot named clean-os. This is your fallback if a tool install goes wrong.

Step 2 — Install the prerequisites

Three runtimes have to be present before the forensic tools will run. Install these first or later steps fail with confusing errors.

1. Java Runtime Environment (required by Autopsy). Install the current JRE.
2. Python 3.10 or newer (required by Plaso and Volatility 3). During the installer, tick Add Python to PATH.
3. Strawberry Perl (required by RegRipper), from strawberryperl.com.

Confirm each is on the PATH from a fresh command prompt:

java -version       # EXPECT: a version line, not "not recognized"
python --version    # EXPECT: Python 3.10 or higher
perl -v             # EXPECT: a Strawberry Perl banner

If any of these says "not recognized", the runtime installed but is not on the PATH; reopen the prompt, and if it still fails, add the install directory to the system PATH before continuing.

Step 3 — Create the evidence directory structure

Every module assumes this layout. The separation between Evidence (raw, never modified), Processed (tool output), and Cases (your notes) is what keeps your work reproducible and your chain of custody defensible. Run this in an elevated PowerShell:

$dirs = @(
    "C:\Forensics\Tools\EZTools",
    "C:\Forensics\Tools\KAPE",
    "C:\Forensics\Tools\Velociraptor",
    "C:\Forensics\Tools\RegRipper",
    "C:\Forensics\Tools\Plaso",
    "C:\Forensics\Tools\TSK",
    "C:\Forensics\Tools\BulkExtractor",
    "C:\Forensics\Tools\Volatility3",
    "C:\Forensics\Cases",
    "C:\Forensics\Evidence",
    "C:\Forensics\Processed",
    "C:\Forensics\Exports",
    "C:\Forensics\Timelines"
)
foreach ($dir in $dirs) {
    New-Item -ItemType Directory -Path $dir -Force | Out-Null
    Write-Host "Created: $dir"
}

The tree you just created, and what each directory holds:

C:\Forensics\
  Tools\                All forensic tools
    EZTools\            Eric Zimmerman's full suite + Timeline Explorer
    KAPE\               KAPE with targets and modules
    Velociraptor\       Velociraptor server and client binaries
    RegRipper\          RegRipper 3.0 with plugins
    Plaso\              Plaso (log2timeline) and pinfo
    TSK\                The Sleuth Kit command-line tools
    BulkExtractor\      Bulk Extractor
    Volatility3\        Volatility 3 memory analysis framework
  Cases\                One subdirectory per investigation
  Evidence\             Raw collected evidence (never modify)
  Processed\            Parsed output from all tools
  Exports\              Filtered data, screenshots, extracted files
  Timelines\            Super timelines from Plaso

Step 4 — Install the core command-line toolstack

These four are what Module 1 and the early analysis modules lean on hardest. Install them first, verify each, and you have a workstation you can start the course on.

Eric Zimmerman's tools (the EZ suite). Download the complete package from ericzimmerman.github.io and extract everything to C:\Forensics\Tools\EZTools\. Add that directory to the system PATH:

[Environment]::SetEnvironmentVariable(
    "PATH",
    [Environment]::GetEnvironmentVariable("PATH", "Machine") + ";C:\Forensics\Tools\EZTools",
    "Machine"
)
# open a NEW prompt, then verify:
PECmd.exe --help    # EXPECT: PECmd usage text

KAPE. Download from Kroll (free registration) and extract to C:\Forensics\Tools\KAPE\. Sync its targets and modules so they are current:

cd "C:\Forensics\Tools\KAPE"
.\kape.exe --sync    # EXPECT: targets and modules download and update

Autopsy (GUI). Download from autopsy.com and run the installer, which bundles The Sleuth Kit, the Java dependencies, and everything else it needs. When it finishes, launch Autopsy, choose New Case, give it a name and output directory, and confirm the case database is created. That test case is your verification that Autopsy runs; delete it afterward. Autopsy is your GUI platform for disk-image analysis, keyword search, and broad artifact extraction when the command-line parsers are not enough.

FTK Imager (GUI). Download from exterro.com and run the installer (there is also a portable build for running from a USB stick during field collection). Launch it once to confirm it opens. FTK Imager is how you mount images and verify evidence hashes.

At this point you can begin Module 1. The remaining tools are installed in Steps 6 to 8 as the course reaches the artifacts that need them.

Step 5 — Lock down the workstation and snapshot

Now that the core tools are installed, restrict the network. A forensic workstation that is analyzing evidence should not have an open path to the internet, because artifacts you extract from a compromised host can include live malware, and a mounted image can contain a payload that tries to call out.

1. In the VM's network settings, set the adapter to host-only or disconnect it. Re-enable it only briefly when you deliberately need to download a tool update.
2. Take a snapshot named clean-baseline. This is the state you revert to before starting a new case, so each investigation begins from a known-good workstation with no residue from the last one.

Step 6 — Add the memory and timeline tools

Volatility and Plaso each carry heavy Python dependencies, so they go in separate virtual environments to keep them from colliding. Re-enable the network for these installs, then cut it again.

# Volatility 3 (memory analysis)
python -m venv "C:\Forensics\Tools\Volatility3\venv"
& "C:\Forensics\Tools\Volatility3\venv\Scripts\Activate.ps1"
pip install volatility3
vol --help          # EXPECT: Volatility 3 usage text
deactivate

# Plaso (super-timelining) in its OWN venv to avoid dependency conflicts
python -m venv "C:\Forensics\Tools\Plaso\venv"
& "C:\Forensics\Tools\Plaso\venv\Scripts\Activate.ps1"
pip install plaso
psort.py --version  # EXPECT: a Plaso version line
deactivate

Step 7 — Add the remaining collection and parsing tools

Install these into their directories under C:\Forensics\Tools\. Each is a download-and-extract or a small installer.

• The Sleuth Kit (CLI). Bundled with Autopsy; for standalone command-line use, download the Windows binaries from sleuthkit.org into C:\Forensics\Tools\TSK\. Verify with fls -V.
• Velociraptor. Download the Windows amd64 binary from the Velocidex GitHub releases into C:\Forensics\Tools\Velociraptor\. Module 1 covers server deployment and agent configuration.
• RegRipper. From the keydet89 GitHub repo, extract to C:\Forensics\Tools\RegRipper\. It needs the Strawberry Perl you installed in Step 2. Verify with perl C:\Forensics\Tools\RegRipper\rip.pl -h.
• Bulk Extractor. From the simsong GitHub releases, extract the Windows binary into C:\Forensics\Tools\BulkExtractor\.
• Encrypted Disk Detector. Magnet Forensics, portable executable, drop it in C:\Forensics\Tools\.
• Arsenal Image Mounter. From arsenalrecon.com; the free version is enough for this course.
• Magnet RAM Capture. Magnet Forensics, portable. This one runs on the target system during acquisition, not on the analysis workstation, so copy it to a USB drive for field use.

Step 8 — A forensic Linux distribution (optional)

If your workflow includes Linux-based analysis, or you need to boot a suspect machine from external media without touching its disk, keep a bootable forensic distribution available. Not required for this course.

• CAINE (caine-live.net) mounts all drives read-only by default and bundles Autopsy, TSK, and Bulk Extractor.
• PALADIN (sumuri.com) is GUI-oriented with built-in imaging.
• CSI Linux (csilinux.com) adds OSINT tooling alongside forensic tools.

Any of these can run as a second VM beside your Windows workstation, giving you Windows-native tools (EZ suite, Timeline Explorer, KAPE) and Linux-native tools (TSK CLI, Bulk Extractor, Plaso) at the same time.

Evidence-handling discipline

Set these habits before Module 1. They are what make your findings hold up when someone else has to reproduce them.

Hash everything on receipt. Before you touch a triage collection or image, compute its SHA256 and record it in your case notes.

Get-FileHash -Algorithm SHA256 "C:\Forensics\Evidence\case-001\triage.zip"

Never write to the evidence directory. Every tool outputs to C:\Forensics\Processed\. The Evidence directory is a read-only archive of the original.

One case, one subdirectory. Create matching subdirectories under Evidence, Processed, and Cases per investigation, named consistently: case-001-workstation, case-002-server-dc01.

Log your commands. Start a transcript at the beginning of every session so you have a record of exactly what you ran.

Start-Transcript -Path "C:\Forensics\Cases\case-001\session-2026-03-15.txt" -Append

Record tool versions. Tool output changes between versions; note the version of every tool you use in a case.

Final check

Your workstation is ready when all of the following are true:

PECmd.exe --help    # EZ suite on PATH, responds
# Autopsy launches and creates a case
# FTK Imager opens
perl C:\Forensics\Tools\RegRipper\rip.pl -h   # RegRipper prints help
vol --help          # (inside the Volatility venv) responds
# Your C:\Forensics directory tree exists
# The VM is on a restricted network and snapshotted as clean-baseline

Module 1 starts with evidence collection: the decisions you make in the first 30 minutes of an investigation, and how KAPE, Velociraptor, and the memory-acquisition tools get evidence onto this workstation for analysis.