Autopsy — Installation & Forensics Guide

→

What it is

Autopsy is a case-based GUI for dead-box forensics: you add a disk image as a data source, run "ingest modules" that automatically extract artifacts, and analyze the results in a timeline and a tree view. The engine is The Sleuth Kit (TSK) — the command-line tools can also be run directly.

Platform reality: Autopsy is primarily developed for Windows and is clearly most stable there. The Linux version can be built but requires more setup (manual TSK + Java dependencies). For serious case work the Windows build is recommended — e.g. in an isolated analysis VM or KASM workspace.

→

Windows installation

recommended

Download the MSI from autopsy.com. The installer bundles TSK, the Java runtime and Solr text indexing.

Steps

# 1. Download the MSI from autopsy.com/download
# 2. Verify SHA-256 against the site
# 3. Run the installer (bundles TSK + JRE + Solr)
# 4. Launch → New Case → enter case name + investigator

Allocate plenty of RAM/disk — Solr indexing of large images is heavy.

Best practice: Always work on a copy of the image, never the original. Use a write blocker during acquisition and document hashes (MD5+SHA256) before and after. Autopsy verifies the image hash automatically when it is added.

→

Linux installation

advanced

Requires The Sleuth Kit, Java and building from source. Expect more troubleshooting than on Windows.

Dependencies (Ubuntu/Zorin)

sudo apt update
sudo apt install sleuthkit openjdk-17-jdk -y

Autopsy

# download the ZIP from github.com/sleuthkit/autopsy/releases
unzip autopsy-*.zip && cd autopsy-*
bash unix_setup.sh
./bin/autopsy

Alternative on Linux: If the Autopsy GUI gives you trouble, use the Sleuth Kit CLI directly — same engine, fully scriptable, and often faster for targeted tasks.

→

Case workflow

The typical sequence from image to report.

Step	What happens
New Case	Create a case with name, number and investigator — all work is isolated per case
Add Data Source	Add a disk image (E01/DD/VMDK), local disk or logical file folder
Configure Ingest	Select modules to run automatically during import
Analyze	Review the tree: file types, deleted files, web history, EXIF, keyword hits
Timeline	Visualize events chronologically (MAC times, web, log events)
Tag & Report	Tag findings, export a report (HTML/Excel/KML)

→

Ingest modules

Modules that automatically extract artifacts on import. The most important ones:

Module	Function
Hash Lookup	Match files against known hash sets (NSRL, custom whitelist/blacklist)
Keyword Search	Index text and search words/regex/patterns (cards, email, URL)
File Type ID	Identify file types by signature (not extension)
Extension Mismatch	Flag files where the extension doesn't match the actual content
Recent Activity	Web history, USB devices, installed software, executed programs
EXIF Parser	Extract metadata/GPS from images
PhotoRec Carver	Carve deleted files from unallocated space
Email Parser	Parse PST/MBOX/EML mailboxes
Android / iOS Analyzer	Mobile artifacts (requires add-ons)
YARA	Run YARA rules against file content during ingest

→

The Sleuth Kit CLI

scriptable

Same engine as Autopsy, but on the command line — ideal on Linux and in automation.

Command	Function
`mmls image.dd`	Show partition table / layout
`fsstat -o OFFSET image.dd`	File system details for a partition
`fls -r -o OFFSET image.dd`	List files/folders recursively (incl. deleted)
`icat -o OFFSET image.dd INODE`	Extract file content by inode number
`istat -o OFFSET image.dd INODE`	Metadata for a specific inode
`blkcat / blkls`	Read / extract raw data blocks (unallocated)
`mactime -b body.txt`	Build a timeline from an fls/ils bodyfile
`tsk_recover -o OFFSET image.dd OUT/`	Bulk-recover all files to a folder
`tsk_gettimes image.dd`	Generate a bodyfile for mactime directly

Timeline on the CLI: tsk_gettimes image.dd > bodyfile && mactime -b bodyfile -d > timeline.csv — produces a sortable CSV without opening the GUI.