autopsy: A digital forensics tool for analyzing hard drives and smartphones for evidence

Autopsy is, without question, the single tool I’ve spent the most hours inside during my forensics career. It’s the graphical front-end to The Sleuth Kit (TSK), packaging file system analysis, keyword searching, timeline generation, hash filtering, and dozens of ingest modules into one case-management platform. In this article I’ll walk through the architecture, installation, workflow, and real casework use of Autopsy from beginner to advanced level.

What Autopsy Is and How It Works

Autopsy is a Java-based application built on top of The Sleuth Kit’s C libraries, which parse raw disk images at the file system level (NTFS, FAT, ext, HFS+, and more) without relying on the host OS to mount anything. Architecturally, it’s organized around:

• Case management — every investigation is a “case” containing one or more “data sources” (disk images, logical file sets, or mobile extractions)
• Ingest modules — pluggable analysis passes that run automatically or on demand: hash lookup, keyword search, EXIF extraction, web artifact parsing, registry analysis, and more (bulk_extractor is even available as one of these modules)
• The Sleuth Kit backend — does the actual low-level parsing of partitions, file systems, and deleted file recovery
• A central case database (SQLite or PostgreSQL for multi-user setups) that stores every artifact, tag, and note so results can be reviewed, filtered, and reported on later

Installing Autopsy

On Kali Linux, it’s typically preinstalled or available via apt:

sudo apt update
sudo apt install -y autopsy

On other Linux distros or when you want the latest release, download directly from the official site and run the installer, or build from source per the project’s documentation. On Windows, the standalone installer is the standard installation path from the official autopsy.com downloads page.

Launching:

autopsy

This starts the local web server/UI (older 2.x branch) or the desktop application (4.x branch), depending on the version installed.

Basic Workflow

1. Create a new case — name, case number, examiner details
2. Add a data source — disk image (E01/dd/raw), local drive, or logical files
3. Select ingest modules — Hash Lookup, Keyword Search, EXIF Parser, Recent Activity, Email Parser, Encryption Detection, etc.
4. Let ingest run — Autopsy processes the data source in the background while you can already start browsing results
5. Review artifacts — browse the file tree, review the “Results” panel for flagged items (deleted files, web history, installed programs, recent documents)
6. Tag evidence and add notes — mark items relevant to the investigation
7. Generate a report — HTML, Excel, or a body-file/timeline export

Real Example Command-Line Usage

While Autopsy is primarily a GUI tool, its underlying Sleuth Kit binaries can be used from the command line for scripted workflows:

# List partition layout of a disk image
mmls case001.dd

# List files in a specific partition
fls -o 2048 case001.dd

# Extract a file by inode number
icat -o 2048 case001.dd 1542 > recovered_file.docx

These same operations happen under the hood whenever you browse a case inside the Autopsy GUI.

Real-World Use Cases

Corporate insider threat investigations — imaging an employee’s laptop (with proper legal authorization), then using Autopsy’s Recent Activity and Web History modules to reconstruct what files were accessed and what external sites were visited before a resignation.

Malware incident triage — running Autopsy against a compromised system image with Hash Lookup enabled against a known-malware hash set (NSRL negative match or custom IOC hash list) to instantly flag suspicious executables.

Mobile device analysis — importing extractions from tools like Cellebrite or an Android/iOS logical dump for unified analysis alongside computer evidence in the same case.

Integration with Other Tools

• hashdeep/md5deep — verifying image integrity before ingest, and importing custom hash sets for known-file filtering.
• bulk_extractor — available directly as an ingest module for fast feature extraction inside the same case.
• Guymager — used to create the forensic image that Autopsy then ingests as a data source.
• Volatility — for memory forensics that complements Autopsy’s disk-focused analysis in a full incident timeline.

Performance and Troubleshooting

• Ingest can be slow on large images with every module enabled; I selectively disable modules I don’t need (like full-text indexing on already-indexed evidence) to speed up triage.
• Use a PostgreSQL multi-user setup when multiple examiners need to work the same case concurrently — the default SQLite case database is single-user only.
• A common mistake: importing an image without verifying its hash first — always confirm image integrity with hashdeep or the acquisition tool’s built-in verification before starting analysis.

Best Practices

• Document every ingest module setting used, since findings need to be reproducible in court or peer review.
• Use the tagging feature consistently and export tagged items directly into your report rather than manually re-searching.
• Keep case databases backed up separately from the original evidence.

FAQ

Is Autopsy free? Yes, it’s fully open source and free, unlike many commercial forensic suites.

Can Autopsy analyze mobile phone extractions? Yes, through its Android/iOS analysis modules and by ingesting extraction files from supported mobile forensic tools.

Does Autopsy modify the original evidence? No — it operates in read-only mode against the image or a write-blocked source; all findings are stored in its separate case database.

Summary

Autopsy remains the backbone of my forensic casework because it brings together file system parsing, artifact analysis, and reporting in one auditable, court-friendly platform — and it does it without a commercial license fee.

References

• Official website: https://www.autopsy.com
• GitHub repository: https://github.com/sleuthkit/autopsy
• The Sleuth Kit documentation: https://www.sleuthkit.org