Autopsy
Autopsy is an open-source digital forensics platform providing a graphical interface over The Sleuth Kit, used to analyze disk images, recover deleted files, and build timelines during forensic investigations.
Definition
Autopsy is an open-source digital forensics platform providing a graphical interface over The Sleuth Kit, used to analyze disk images, recover deleted files, and build timelines during forensic investigations.
Overview
Developed by Basis Technology, Autopsy is widely used by law enforcement, corporate investigators, and forensic students as a free alternative to commercial forensic suites. It examines disk and memory images without altering the original evidence, preserving chain of custody throughout an investigation. Its modules cover keyword search, timeline analysis, web artifact recovery, hash-based filtering, and recovery of deleted or hidden files. It's often used during incident-response investigations alongside security-testing tools such as Burp Suite, and is typically run from forensics-oriented Linux environments where scripting with Bash supports repeatable analysis workflows.
Key Features
- Graphical front end for The Sleuth Kit forensic analysis libraries
- Timeline analysis for reconstructing a sequence of system events
- Keyword search and hash-based filtering across disk images
- Recovery of deleted files and analysis of file system artifacts
- Extensible via modules for web history, registry, and email analysis
- Read-only evidence handling to preserve chain of custody