Installing Autopsy

Table of Contents

• Deployment Types
• Download
• System Requirements
  • AntiVirus
  • Memory
• Single-User Installation
• Proxies
• Windows File Association

Deployment Types

There are two ways to deploy Autopsy:

• Single-User: Cases can be opened by only a single instance of Autopsy at a time. Autopsy installations do not communicate with each other. This is the easiest to install and deploy. This page outlines that installation process.
• Multi-User: Cases can be opened by multiple users at the same time and users can see what each other is doing. This collaborative deployment requires installation and configuration of other network-based services. The installation of this deployment is covered in Setting Up Multi-user Cluster.

Download

Regardless of the deployment type, you can download Autopsy from the website:

http://sleuthkit.org/autopsy/download.php

We distribute a Windows installer and ZIP files to run on Linux and OS X.

System Requirements

AntiVirus

You should consider either disabling AntiVirus software that runs on your computers that will be running Autopsy or configuring your AntiVirus software to ignore the contents of your case output directory. AntiVirus software may quarantine or even delete some of your results before you get a chance to look at them. Autopsy encodes some of the files that it extracts so that they can not be executed or scanned, but some modules (such as our ZIP extraction module) will directly write files to disk in an unencoded format.

Of course, the risk with disabling AntiVirus software is that your computer could be infected with malware that came from your media.

Memory

We recommend a minimum of 16GB of RAM.

By default, Autopsy will use a maximum of 4GB of RAM (not including memory that the Solr text indexing server uses). You can increase this size after installation by changing the Maximum JVM Memory value in the Runtime section under Tools -> Options -> Application.

Single-User Installation

To install Autopsy, perform the following steps:

1. Run the Autopsy msi file
2. If Windows prompts with User Account Control, click Yes
3. Click through the dialog boxes until you click a button that says Finish
4. Autopsy should now be fully installed

Proxies

If you are behind a proxy and need access to a network with Autopsy or one of the modules, you may set your proxy information in the Tools, Options, General tab as shown in the screenshot below.

Windows File Association

If desired, you can set up a Windows file association for .aut files and the Autopsy executable (normally C:\Program Files\Autopsy-(current version)\bin\autopsy64.exe). This will allow you to double click on the .aut file for a case to launch Autopsy with the selected case open. Instructions for setting up file associations can be found by doing a web search for "how to set Windows file associations".