Autopsy is a graphical interface to the
command line digital investigation analysis tools in The Sleuth Kit. Together, they
can analyze Windows and UNIX disks and file systems (NTFS, FAT,
The Sleuth Kit and Autopsy are both Open Source and run on UNIX
platforms (you can use Cygwin to run them both on Windows). As Autopsy is HTML-based, you can connect
to the Autopsy server from any platform using an HTML browser.
Autopsy provides a "File Manager"-like interface and shows details
about deleted data and file system structures.
- A dead analysis occurs when a dedicated analysis system is
used to examine the data from a suspect system. In this case, Autopsy and The Sleuth Kit
are run in a trusted environment, typically in a lab.
Autopsy and TSK support raw, Expert Witness, and AFF file formats.
- A live analysis occurs when the suspect system is being analyzed
while it is running. In this case, Autopsy and The Sleuth Kit
are run from a CD in an untrusted environment. This is frequently
used during incident response while the incident is being confirmed. After
it is confirmed, the system can be acquired and a dead analysis
Evidence Search Techniques
- File Listing: Analyze the files and directories,
including the names of deleted files and files with Unicode-based names. (screenshot)
- File Content: The contents of files
can be viewed in raw, hex, or the ASCII strings can be extracted.
When data is interpreted, Autopsy sanitizes it to prevent damage
to the local analysis system. Autopsy does not use any client-side
scripting languages. (screenshot)
Kit Informer #1)
- Hash Databases: Lookup unknown files in a hash database
to quickly identify it as good or bad. Autopsy uses the NIST
National Software Reference Library (NSRL) and user created
databases of known good and known bad files. (screenshot)
- File Type Sorting: Sort the files based on their
internal signatures to identify files of a known type. Autopsy
can also extract only graphic images (including thumbnails). The
extension of the file will also be compared to the file type to
identify files that may have had their extension changed to hide
- Timeline of File Activity: In some cases,
having a timeline
of file activity can help identify areas of a file system that
may contain evidence. Autopsy can create timelines that contain
entries for the Modified, Access, and Change (MAC) times of both
allocated and unallocated files. (screenshot)
- Keyword Search: Keyword searches of the file
system image can be performed using ASCII strings and grep regular
expressions. Searches can be performed on either the full file
system image or just the unallocated space. An index file can
be created for faster searches. Strings that are frequently
searched for can be easily configured into Autopsy for automated
- Meta Data Analysis: Meta Data structures
contain the details about files and directories. Autopsy allows
you to view the details of any meta data structure in the file
system. This is useful for recovering deleted content. Autopsy
will search the directories to identify the full path of the file
that has allocated the structure. (screenshot)
- Data Unit Analysis: Data Units are where
the file content is stored. Autopsy allows you to view the
contents of any data unit in a variety of formats including ASCII,
hexdump, and strings. The file type is also given and Autopsy
will search the meta data structures to identify which has
allocated the data unit. (screenshot)
- Image Details: File system details can be
viewed, including on-disk layout and times of activity. This
mode provides information that is useful during data recovery.
- Case Management: Investigations are organized
by cases, which can contain one or more hosts.
Each host is configured to have its own time zone setting and
clock skew so that the times shown are the same as the original
user would have seen. Each host can contain one or more file
system images to analyze.
(screenshot) (Sleuth Kit
- Event Sequencer: Time-based events can be
added from file activity or IDS and firewall logs. Autopsy
sorts the events so that the sequence of incident events can
be more easily determined.
- Notes: Notes can be saved on a per-host and
per-investigator basis. These allow you to make
quick notes about files and structures. The original location
can be easily recalled with the click of a button when the notes
are later reviewed. All notes are stored in an ASCII file. (screenshot )
- Image Integrity: It is crucial to ensure
that files are not modified during analysis. Autopsy, by default,
will generate an MD5 value for all files that are imported or
created. The integrity of any file that Autopsy uses can be
validated at any time. (screenshot)
- Reports: Autopsy can create ASCII reports
for files and other file system structures. This enables you
to quickly make consistent data sheets during the
- Logging: Audit logs are created on a case,
host, and investigator level so that actions can be easily
recalled. The exact Sleuth Kit commands that are executed
are also logged.
- Open Design: The code of Autopsy is open
source and all files that it uses are in a raw format. All
configuration files are in ASCII text and cases are organized by
directories. This makes it easy to export the data and archive
it. It also does not restrict you from using other tools that
may solve the specific problem more appropriately.
- Client Server Model: Autopsy is HTML-based
and therefore you do not have to be on the same
system as the file system images. This allows multiple investigators
to use the same server and connect from their personal systems.
Autopsy is written in Perl and runs on the same UNIX platforms as
The Sleuth Kit:
- Mac OS X
- Open & FreeBSD
- Cygwin (you cannot use the win32 executables that can be downloaded from this site, you must build in Cygwin)
If you have a feature request, refer to the Support page for details on submitting it.