Fast Results

As media grows in size, it takes longer to analyze all of it. Physics prevents us from getting all of the evidence before we get a cup of coffee, but Autopsy will tell you about evidence as soon as it knows it and will try to find the most relevant evidence first.

Autopsy has several features to get you evidence faster:

• Multiple ingest modules run in parallel to take advantage of multi-core systems.
• Time intensive steps can be disabled for a faster, but less thorough analysis (i.e. triage). For example, you can skip searching for orphan FAT files and skip analysis of unallocated space.
• User folders and files are prioritized over system folders and files.
• Results from ingest modules are, in general, given as soon as they are found. The ingest inbox provides feedback on what modules are reporting.