This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| Autopsy (software) | |
|---|---|
| Name | Autopsy |
| Developer | Basis Technology; National Security Agency |
| Released | 2001 |
| Programming language | Java, C++ |
| Operating system | Microsoft Windows, Linux |
| License | Apache License |
Autopsy (software) is an open-source digital forensics platform originally created for forensic analysis, incident response, and e-discovery. It integrates case management, timeline analysis, file carving, and reporting capabilities used by investigators, analysts, and legal teams across law enforcement, corporate security, and academic research. The project is associated with Basis Technology and has ties to the National Security Agency through early development and contributions.
Autopsy provides a graphical front end for forensic engines that process disk images, logical files, and mobile device data. It supports forensic workflows used by practitioners from organizations such as Federal Bureau of Investigation, Department of Justice (United States), Metropolitan Police Service, Interpol, and private firms like KPMG, Deloitte, and EY. The platform interoperates with tools and standards including Sleuth Kit, The Sleuth Kit (TSK), Digital Forensics XML (DFXML), EnCase Forensic, and Open Computer Forensics Architecture. Autopsy aims to lower barriers to forensic analysis for users familiar with platforms such as Helix (software), FTK (Forensic Toolkit), and X-Ways Forensics.
Development of Autopsy began in 2001 as a graphical interface for The Sleuth Kit at Lawrence Livermore National Laboratory and later evolved through academic and government collaborations involving researchers from MIT, Carnegie Mellon University, and contributors associated with the National Security Agency. Basis Technology later adopted stewardship, integrating work from contributors who had affiliations with Google Summer of Code, Open Source Initiative, and projects funded by agencies such as Defense Advanced Research Projects Agency and National Institutes of Health where relevant forensic research intersected. The codebase expanded through community contributions hosted on platforms similar to GitHub, and releases have coincided with conferences like Black Hat, DEF CON, and Digital Forensics Research Workshop where new modules and capabilities were announced.
Autopsy features a modular architecture built atop The Sleuth Kit for low-level file system analysis and uses Java-based modules for higher-level processing. Core components include ingestion pipelines, timeline visualization, file system viewers, and keyword search indexes compatible with Apache Lucene technologies. The GUI integrates viewers for artifacts such as web browser histories, email containers, registry hives, and media files generated by vendors like Microsoft Corporation, Google, Apple Inc., and Mozilla Foundation. Extension points enable custom modules developed by practitioners from agencies such as United States Secret Service and corporate incident response teams at Cisco Systems and Microsoft. The architecture supports multi-user case collaboration and export formats compatible with PDF, CSV, and forensic report standards used in courts like those overseen by U.S. District Court jurisdictions.
Autopsy supports disk image formats and containers including EnCase image format, Advanced Forensic Format, raw image format, and logical exports from systems such as Windows NTFS, FAT, and ext4 used in distributions like Ubuntu and Red Hat Enterprise Linux. Modules parse artifacts from email formats like MBOX, PST (Microsoft Outlook), and mobile artifacts from Apple iOS backups and Android devices. Analysis plugins handle artifacts produced by applications and services from WhatsApp, Facebook, Twitter, Slack (software), and cloud providers such as Amazon Web Services and Google Cloud Platform through API-based ingestion. Specialized modules perform memory analysis interoperable with tools like Volatility (software) and extract metadata compliant with standards from National Institute of Standards and Technology publications.
Investigators initiate cases by creating case files, ingesting images and evidence sources, and running modules for timeline, hash set matching against repositories such as National Software Reference Library, and keyword searches guided by legal teams from firms like Baker McKenzie or Latham & Watkins. For incident responders at organizations such as CrowdStrike, Mandiant, and FireEye, Autopsy integrates into triage workflows with indicators of compromise reported to platforms like MITRE ATT&CK and threat intelligence feeds from VirusTotal. Law enforcement workflows include chain-of-custody documentation and report generation for prosecution in courts including Crown Court (England and Wales) and United States Court of Appeals panels. Academic users employ Autopsy in curricula at institutions like University of California, Berkeley, Georgia Institute of Technology, and University College London.
Autopsy has been adopted widely across public and private sectors, cited in training programs by FBI Academy, International Association of Computer Investigative Specialists, and vendor-neutral certifications such as GIAC Certified Forensic Analyst. Reviews in practitioner venues at Black Hat and case studies from firms like KPMG and Deloitte highlight strengths in modularity and community support, while comparative analyses reference commercial suites like EnCase and FTK. Academic literature published in journals associated with IEEE and conferences like USENIX discuss Autopsy’s extensibility and role in reproducible research.
Autopsy is distributed under the Apache License which permits modification and commercial use, leading to commercial deployments by vendors and integrations with proprietary systems from Basis Technology and other firms. Legal admissibility of results depends on forensic procedures recognized by courts such as Supreme Court of the United States precedents and standards advocated by Scientific Working Group on Digital Evidence. Security considerations include safe handling of evidence images to avoid contamination, proper use of hashing algorithms like SHA-1 and SHA-256 for integrity verification, and compliance with privacy regulations such as General Data Protection Regulation when processing data from subjects in European Union jurisdictions.
Category:Digital forensics software