Forensics
Autopsy is a digital forensics platform and graphical interface to The Sleuth Kit and other digital forensics tools used to investigate what happened on a computer.
sudo apt install autopsy
autopsy (GUI application)
Autopsy is an open-source digital forensics platform and the graphical interface to The Sleuth Kit (TSK). It is widely used by law enforcement, corporate investigators, and incident response teams to examine disk images and extract digital evidence.
Originally developed by Brian Carrier, Autopsy provides an extensible architecture with ingest modules for file analysis, keyword searching, timeline generation, hash database lookups, and web artifact extraction.
Autopsy supports evidence from hard drives, SSDs, mobile devices, and disk image files in formats like E01, RAW, VHD, and VMDK. Its modular design allows forensic analysts to customize workflows for criminal investigations, corporate audits, and incident response engagements.
autopsyStart the Autopsy Forensic Browser web server on localhost:9999autopsy -p 9999Start Autopsy listening on a specific TCP portautopsy -d /path/to/evidenceUse a specific evidence locker directory for casesautopsy -i 192.168.1.10Bind the Autopsy web server to a specific IP addressautopsy -CRun Autopsy without requiring browser cookiesmmls /path/to/image.ddDisplay the partition layout of a disk imageimg_stat /path/to/image.ddShow details about a forensic image file and its formatfsstat -o 2048 /path/to/image.ddPrint file system details for the partition at an offsetfls -r -o 2048 /path/to/image.ddRecursively list files and directories, including deleted onesfls -rd -o 2048 /path/to/image.ddList only deleted file entries recursivelyicat -o 2048 /path/to/image.dd 12345Extract the content of a file by its inode numberistat -o 2048 /path/to/image.dd 12345Show metadata for a specific inode (times, size, blocks)ils -o 2048 /path/to/image.ddList inode information, focusing on deleted inodesffind -o 2048 /path/to/image.dd 12345Find the file name(s) that point to a given inodeifind -o 2048 -n /etc/passwd /path/to/image.ddFind the inode associated with a file nameMount and analyze forensic disk images to recover deleted files, examine file system structures, and extract evidence from storage media.
Build chronological timelines of file system activity, user actions, and system events to understand what happened during an incident.
Compare file hashes against NSRL and custom hash databases to identify known files, known-bad software, and reduce analysis time.
Search across all file contents and metadata for specific keywords, patterns, and regular expressions to locate relevant evidence.
Extract browser history, cookies, downloads, and cached web content to trace online activity.
Parse and examine email databases from Outlook, Thunderbird, and web-based clients to extract communication evidence.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.