GUI-based digital forensics platform built on The Sleuth Kit for disk image analysis, file carving, and timeline generation.
autopsyautopsySandbox: execFile · Timeout: 3600s
disk.analysis.image forensics.file.carving forensics.timeline.generation forensics.keyword.search forensics.hash.analysis | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
help | boolean | No | - | Display help message | --help |
version | boolean | No | - | Display version information | --version |
no-browser | boolean | No | - | Do not open the browser on startup | --no-browser |
flag-p | integer | No | 9999 | Port to bind the web interface | -p, --port |
flag-H | string | No | 127.0.0.1 | Host address to bind | -H, --host |
admin-pass | string | No | - | Administrator password for first-run setup | --admin-pass |
ingest-modules | string | No | - | Comma-separated list of ingest modules to run | --ingest-modules |
keyword-list | file | No | - | File containing keywords to search | --keyword-list |
hash-db | file | No | - | Hash database for known file matching | --hash-db |
flag-version | boolean | No | - | Show Autopsy version | -version, --version |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
disk.image.raw | Raw disk image for analysis | application/octet-stream | - | verified |
forensics.report.html | Autopsy analysis report in HTML | text/html | - | verified |
forensics.case.database | Autopsy case database (SQLite) | application/x-sqlite3 | - | verified |
Inputs
disk.image.file Path to the disk image to analyze
directory.path Case directory for storing results
forensics.ingest.module Ingest module configuration
Outputs
forensics.report.html HTML analysis report
forensics.file.carved Recovered carved files
filesystem_writefilesystem_write Produces
forensics.report.htmlforensics.file.carvedConsumes
disk.image.filedirectory.pathforensics.ingest.module| Resource | Value |
|---|---|
| CPU | medium |
| Memory | 1024 MB |
| Network | low |
| Disk I/O | high |
Start Autopsy web interface on default port
autopsyStart Autopsy on a custom port without opening browser
autopsy --no-browser -p 9999Bind to all network interfaces
autopsy -H 0.0.0.0Start with specific ingest modules
autopsy --ingest-modules "RecentActivity,HashLookup,KeywordSearch"Display help
autopsy --helpShow version
autopsy --versionAutopsy is a GUI-based digital forensics platform built on The Sleuth Kit. It provides disk image analysis, file carving, keyword search, timeline generation, and hash set analysis through an intuitive web interface.