Autopsy is a computer program that performs forensic searches of computer storage volumes. It is maintained by Basis Technology Corp. and community programmers. Basis Technology Corp. sells support services and training for the program.
Features
Cataloguing Autopsy hashes the files in the volume it is analyzing, unpacking compressed archives including ZIP and JAR. It extracts image metadata stored as Exif values and stores keywords in an index. Further, Autopsy parses and catalogues some email and contact file formats, flags phone numbers, email addresses, and files, as well as SQLite or PostgreSQL database stores occurrences of names, domains, phone numbers, and Windows registry files indicating past connections to USB devices. Multiple file systems can be catalogued in the same repository.
Search Autopsy can perform rule-based searches of indexed files, including searches for recent activity. It can generate reports in HTML or PDF format containing the results of searches. A partial image of files returned by a search can be saved in VHD format.
File recovery Autopsy can be used to recover data that has been infected by WannaCry ransomware.S. C. Nayak, V. Tiwari and B. K. Samanthula, "Review of Ransomware Attacks and a Data Recovery Framework using Autopsy Digital Forensics Platform," 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, 2023, pp. 0605–0611, doi: 10.1109/CCWC57344.2023.10099169.
Tools Autopsy includes a graphical user interface to display its results, wizards and historical tools to repeat configuration steps, and plug-in support. Both open-source and closed-source Modules exist for the core browser, including functionality related to scanning files, browsing results, and summarizing findings.
File systems Supported file systems include:
NTFS FAT ExFAT HFS+ Ext2 Ext3 Ext4 YAFFS2
Dependencies Autopsy runs open source programs and plugins included in The Sleuth Kit. It depends on a number of libraries with various licenses. It uses SQLite and PostgreSQL databases to store information. Its keyword search indices are built with Lucene and SOLR.
Version history +VersionLanguageOperating systemsLicense2.0PerlLinux, Unix, MacOS, WindowsGNU GPL 2.03.0JavaApache license 2.04.0JavaWindows, Linux, MacOSApache license 2.0
References
External links Autopsy official website The Sleuth Kit official website