$ forensic4linux ~
Tool Guide · gui

Autopsy

Category: graphical forensics platform · License: Apache 2.0

Contents

  1. What it does
  2. Install
  3. Creating a case & ingesting data
  4. Ingest modules
  5. Exploring evidence
  6. Timeline view
  7. Reports

What it does

Autopsy wraps The Sleuth Kit in a browser-based GUI with a case-management model, automated "ingest" modules, hash lookups, keyword search, and reporting. You get the rigor of TSK with point-and-click exploration — ideal for triage, for large evidence sets, and for producing court-ready reports. It runs on Linux, Windows, and macOS.

Install

# Debian / Ubuntu
apt install autopsy     # classic, runs TSK tools in the terminal

# modern Autopsy 4.x - download from sleuthkit.org
# the .deb/.rpm self-installs Java + bundled TSK + testdisk
wget https://downloads.sleuthkit.org/autopsy/autopsy-4.22.0.zip
unzip autopsy-4.22.0.zip -d /opt
/opt/autopsy-4.22.0/bin/autopsy
Baseline discipline Autopsy never writes to the evidence. Configure it to work from your forensic image and let it store all its case data in a separate case directory.

Creating a case & ingesting data

Workflow in the UI:

  1. New Case — name, case directory, investigator, notes.
  2. Add Data Source — point at your image (.dd, .E01, or a mounted folder).
  3. Choose Ingest Modules (see below) and run.
  4. Explore results and export evidence.
# ensure the image is verified before ingestion
sha256sum /evidence/image.dd
mmls /evidence/image.dd        # confirm Autopsy will see the partition layout

Ingest modules

ModuleWhat it extracts
Recent ActivityRecent files, OS-level user activity
Hash LookupFlag known-bad / known-good via NIST NSRL, custom hashes
Keyword SearchIndexed + regex keyword hits
Web ArtifactsBrowser history, cookies, downloads
File Type IdentificationClassify by content signature (not extension)
Extracted ContentAuto-extract embedded images, GPS, etc.
Data Source IntegrityHash verification of the image
Virtual MachineExtract from VMware/VirtualBox disk files

Exploring evidence

Key views after ingest:

Timeline view

Autopsy's timeline (Directory Tree → Timeline) renders the same MAC-time data TSK produces, but with filtering and charting. Narrow to a suspicious date range, then cross-reference with log evidence.

Reports

From the Results view, right-click → Generate Report. Choose HTML, text, or Excel/CSV. A good report includes: case info, data source hash, tools/versions, findings with paths and times, and exported artifacts. The Excel export is handy for pivot tables.

← Previous: The Sleuth Kit  ·  Next: Volatility →