Autopsy User's Guide

Overview

This is the User's Guide for the open source Autopsy platform. Autopsy allows you to examine a hard drive or mobile device and recover evidence from it. This guide should help you with using Autopsy. The developer's guide will help you develop your own Autopsy modules.

Note: For those users running Autopsy on Mac devices, the functionality available through the "Tools" -> "Options" dialog as described in this documentation can be accessed through the system menu bar under "Preferences" or through the Cmd + , (command-comma) shortcut.

Help Topics

The following topics are available here:

• Installation
  • Installing Autopsy
  • Optimizing Performance
  • Multi-user Cluster
    • Setting Up Multi-user Cluster
    • Multi-user Case Security
    • Using Multi-user Cases
• Quick Start Guide
• Cases and Adding Data Sources
  • Autopsy Workflow
  • Cases
  • Data Sources
  • Viewing Case Logs and Output
• Ingest Modules
  • Ingest Modules
  • Recent Activity Module
  • Hash Lookup Module
  • File Type Identification Module
  • Embedded File Extraction Module
  • EXIF Parser Module
  • Keyword Search Module
  • Email Parser Module
  • Extension Mismatch Detector Module
  • Data Source Integrity Module
  • Android Analyzer Module
  • Interesting Files Identifier Module
  • PhotoRec Carver Module
  • Correlation Engine Module
  • Encryption Detection Module
  • Virtual Machine Extractor Module
  • Plaso
  • Drone Analyzer
  • GPX Analyzer
• Reviewing the Results
  • UI Layout
  • Tree Viewer
  • Result Viewer
  • Content Viewer
  • Machine Translation
• Searching
  • UI Quick Search
  • File Search
  • Ad Hoc Keyword Search
  • STIX
  • Common Properties Search
  • Search All Cases
• Specialized Viewers
  • Image Gallery Module
  • Timeline
  • Communications Visualization Tool
  • Geolocation
  • File Discovery
• Reporting
  • Tagging
  • Reporting
• Installing 3rd-Party Modules
• Central Repository
• Other Workflows
  • Triage
    • Triage
    • Creating a Live Triage Drive
  • Logical Imager
  • Command Line Ingest
• Experimental Module
  • Experimental Module
  • Automated Ingest
  • Object Detection
  • Volatility Data Source Processor
• Translating Documentation and the UI

If the topic you need is not listed, then you can:

• Refer to the Autopsy Wiki
• Ask a question on the Forum
• Ask a question on the Email List.