Autopsy Forensic Browser

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.

Autopsy 3 was a complete rewrite from Autopsy 2 to make it Java-based. Autopsy 4 improves on Autopsy 3 by supporting collaboration on a single case by multiple users.

Although Autopsy is designed to be cross-platform (Windows, Linux, MacOSX), the current version is fully functional and fully tested only on Windows. We have ran it on Windows XP, Vista, and 7 with no problems.

Autopsy 4 is released under the Apache 2.0 license. Some libraries Autopsy uses may have different, but similar, open source licenses.

Easy to Use

Autopsy was designed to be intuitive out of the box. Installation is easy and wizards guide you through every step. All results are found in a single tree. See the intuitive page for more details.

Extensible

Autopsy was designed to be an end-to-end platform with modules that come with it out of the box and others that are available from third-parties. Some of the modules provide:

• Timeline Analysis - Advanced graphical event viewing interface (video tutorial included).
• Hash Filtering - Flag known bad files and ignore known good.
• Keyword Search - Indexed keyword search to find files that mention relevant terms.
• Web Artifacts - Extract history, bookmarks, and cookies from Firefox, Chrome, and IE.
• Data Carving - Recover deleted files from unallocated space using PhotoRec
• Multimedia - Extract EXIF from pictures and watch videos.
• Indicators of Compromise - Scan a computer using STIX.

Fast

Everyone wants results yesterday. Autopsy runs background tasks in parallel using multiple cores and provides results to you as soon as they are found. It may take hours to fully search the drive, but you will know in minutes if your keywords were found in the user's home folder. See the fast results page for more details.

Cost Effective

Autopsy is free. As budgets are decreasing, cost effective digital forensics solutions are essential. Autopsy offers the same core features as other digital forensics tools and offers other essential features, such as web artifact analysis and registry analysis, that other commercial tools do not provide.