Digital Forensics

autopsy

autopsy puts a case-driven graphical interface on top of The Sleuth Kit. Instead of running individual command-line tools, you create a case, add a disk image as a data source, and let Autopsy’s ingest modules work through it — recovering deleted files, building timelines, extracting web history and email, carving files, flagging known-bad hashes, and indexing everything for keyword search. It’s built for real investigations where you need organized results, a repeatable workflow, and a report at the end.

Autopsy is a graphical application, launched into its own window from Security → Digital Forensics → autopsy. Installed from the AUR (a large download — the release bundle is over a gigabyte).

Using it

1. Create a case — give it a name and an investigator; Autopsy keeps all findings organized under it.
2. Add a data source — a disk image, a local drive, or a folder of files.
3. Choose ingest modules — file-type ID, hash lookup, keyword search, EXIF, web artifacts, and more run automatically as the source is processed.
4. Explore the results in the tree: recovered and deleted files, a timeline, extracted artifacts, and keyword hits, all cross-referenced.
5. Tag findings and generate a report in HTML or other formats for the case record.

Autopsy and The Sleuth Kit share the same engine, so anything Autopsy surfaces you can also reach with the command-line tools — the GUI is about case management and scale.