[amazon_link asins=’0128016353,1597495867,1285060032,1785887106,1517713609′ template=’ProductCarousel’ store=’secure001a-20′ marketplace=’US’ link_id=’2f9f1c3b-bd4c-11e7-b344-27bce27720b0′]

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera’s memory card.

Support Windows 32-bit and 64-bit operating system, the same support for Linux and OSX (download the source code, compile their own).


  • Multi-User Cases: Collaborate with fellow examiners on large cases.
  • Timeline Analysis: Displays system events in a graphical interface to help identify activity.
  • Keyword Search: Text extraction and index searched modules enable you to find files that mention specific terms and find regular expression patterns.
  • Web Artifacts: Extracts web activity from common browsers to help identify user activity.
  • Registry Analysis: Uses RegRipper to identify recently accessed documents and USB devices.
  • LNK File Analysis: Identifies shortcuts and accessed documents
  • Email Analysis: Parses MBOX format messages, such as Thunderbird.
  • EXIF: Extracts geolocation and camera information from JPEG files.
  • File Type Sorting: Group files by their type to find all images or documents.
  • Media Playback: View videos and images in the application and not require an external viewer.
  • Thumbnail viewer: Displays thumbnail of images to help quick view pictures.
  • Robust File System Analysis: Support for common file systems, including NTFS, FAT12/FAT16/FAT32/ExFAT, HFS+, ISO9660 (CD-ROM), Ext2/Ext3/Ext4, Yaffs2, and UFS from The Sleuth Kit.
  • Hash Set Filtering: Filter out known good files using NSRL and flag known bad files using custom hashsets in HashKeeper, md5sum, and EnCase formats.
  • Tags: Tag files with arbitrary tag names, such as ‘bookmark’ or ‘suspicious’, and add comments.
  • Unicode Strings Extraction: Extracts strings from unallocated space and unknown file types in many languages (Arabic, Chinese, Japanese, etc.).
  • File Type Detection based on signatures and extension mismatch detection.
  • Interesting Files Module will flag files and folders based on name and path.
  • Android Support: Extracts data from SMS, call logs, contacts, Tango, Words with Friends, and more.

Changelog 4.5.0

  • Memory usage has been reduced to improve support for very large cases.
  • New central repository feature has been added that allows you to correlate between cases and track if an item was previously identified as being “bad” or notable.
  • Message attachments are not associated with the message (and not just the source file). These can be found in the data sources and messages parts of the tree.
  • Credit card number search has added logic to reduce false positives based on number lengths.
  • Virtual directory nodes in the tree view are distinguished in the Data Sources tree by the addition of a “V” to their icon. These are folders that Autopsy/TSK created.
  • A new version of the automated ingest dashboard has been added to allow insight into pending, running and completed automated ingest jobs in automated ingest Examiner mode.
  • All occurrences of “Known Bad” in the user interface have been changed to “Notable.”
  • Assorted small enhancements and bug fixes are included.