Autopsy User's Guide

Overview

This is the User's Guide for the open source Autopsy platform. Autopsy allows you to examine a hard drive or mobile device and recover evidence from it. This guide should help you with using Autopsy. The developer's guide will help you develop your own Autopsy modules.

Autopsy 3 is a complete rewrite from Autopsy 2, and none of this document is relevant to Autopsy 2.

Help Topics

The following topics are available here:

• Installation
• Quick Start Guide
• Autopsy Workflow
• Cases and Adding Data Sources
  • Cases
  • Data Sources
  • UI Layout
• Automated Analysis (Modules)
  • Ingest Modules
  • Recent Activity Module
  • Hash Database Lookup Module
  • File Type Identification Module
  • Embedded File Extraction Module
  • EXIF Parser Module
  • Keyword Search Module
  • Email Parser Module
  • Extension Mismatch Detector Module
  • E01 Verifier Module
  • Android Analyzer Module
  • Interesting Files Identifier Module
  • PhotoRec Carver Module
• Manual Analysis
  • Tree Viewer
  • Result Viewer
  • Content Viewer
  • File Search
  • Timeline
  • STIX
• Reporting
  • Tagging
  • Reporting
• Installing 3rd-Party Modules

If the topic you need is not listed, refer to the Autopsy Wiki or join the SleuthKit User List at SourceForge.