Forensicsforensicssleuthkitdigital-forensicsfile-system-analysis

Autopsy

Autopsy is a graphical interface to The Sleuth Kit for digital forensic analysis of Windows and UNIX file systems. It provides features comparable to commercial digital forensics tools.

Description

The Autopsy Forensic Browser serves as a graphical interface to the command line digital forensic analysis tools in The Sleuth Kit. Together, they enable analysis of file systems such as NTFS, FAT, FFS, EXT2FS, and EXT3FS on Windows and UNIX systems.

Autopsy is designed for forensic investigators needing a user-friendly way to examine disk images and live systems. It supports evidence locker management and live analysis configurations, making it suitable for both post-mortem investigations and real-time data acquisition.

Key use cases include recovering deleted files, analyzing file timelines, and generating reports for legal proceedings. The tool integrates seamlessly with Sleuth Kit's backend for comprehensive disk analysis.

How It Works

Autopsy operates as a web-based server that provides a graphical interface to The Sleuth Kit's command-line tools. It runs on a specified port (default 9999), allowing browser access from localhost or remote hosts. Users configure evidence lockers for storing case data and can perform live analysis by specifying device, filesystem, and mount point. Cookie handling in URLs controls session management.

Installation

bash

sudo apt install autopsy

Flags

-cforce a cookie in the URL

-Cforce NO cookie in the URL

-d dirspecify the evidence locker directory

-i device filesystem mntSpecify info for live analysis

-p portspecify the server port (default: 9999)

Examples

Start Autopsy server on default port 9999 with localhost access

autopsy

Start Autopsy forcing a cookie in the URL

autopsy -c

Start Autopsy forcing no cookie in the URL

autopsy -C

Start Autopsy specifying custom evidence locker directory

autopsy -d /path/to/evidence

Start Autopsy for live analysis of /dev/sda with ext4 filesystem mounted at /mnt

autopsy -i /dev/sda ext4 /mnt

Start Autopsy server on custom port 8080

autopsy -p 8080

Start Autopsy allowing browser access from remote host 192.168.1.100

autopsy 192.168.1.100

Start Autopsy on port 9999 with remote host access

autopsy -p 9999 192.168.1.100

Updated 2026-04-16kali.org ↗