LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.Sleuth Kit Labs
Autopsy
Autopsy is a free, open source examination platform that puts a graphical interface and ingest modules on top of The Sleuth Kit. For a student it is the first tool that shows a whole case from image to report at no cost.
PlatformOpen sourceCurrentWindows · Linux · macOS
Profile
- Manufacturer
- Sleuth Kit Labs
- Category
- Computer forensics
- Product type
- Platform
- Platforms
- Windows, Linux, macOS
- Licensing
- Open source
- Product status
- Current
- Educational level
- Beginner
- Last verified
- 2 November 2026
Autopsy's site credits Sleuth Kit Labs and states that the software is free to download and use. The Apache 2.0 licence comes from the project's public source repository README. The download page offers a 64-bit Windows MSI and a Linux and macOS ZIP for version 4.23.1. Basis Technology is not named on the current page.
What Autopsy is
Autopsy is published by Sleuth Kit Labs and released under the Apache 2.0 licence, so a college lab can install it on every machine without a procurement file. The download page offers a 64-bit Windows installer and a ZIP build for Linux and macOS, with version 4.23.1 current when checked. The program opens a disk image, a local drive or a folder of files, runs a set of ingest modules over it and presents results in a tree: file systems, deleted files, web history, recent documents, email, images with EXIF data, keyword hits and hash matches. A timeline view and a report generator complete the loop.
Two things make Autopsy valuable beyond its price. The source is open, which means an examiner can read exactly how a module reached its result, something no commercial tool allows. And its module system invites extension, so a lab can write its own parsers in Java or Python. The maker's site also promotes its commercial incident response product Cyber Triage and offers two Cyber Triage add-ons for Autopsy, a malware scanner and an importer. Autopsy's history runs through Basis Technology, where the project lived before Sleuth Kit Labs; that history is not on the current product page and is mentioned here only to explain older references.
Primary applications
Where it is used
- Full examination of a computer image in teaching and in small laboratories
- Keyword search and hash matching across an image
- Web history, recent activity and email review on Windows images
- Timeline analysis of file system and application events
- A second, independent tool to confirm a commercial tool's result
- Writing custom ingest modules for new artefact types
Who uses it
- Students and institutes
- Small police units and private examiners on a limited budget
- Researchers and developers building new parsers
- Laboratories that need an independent verification tool
Capabilities and limits
Major capabilities
- Graphical interface over The Sleuth Kit with ingest modules for common artefacts
- Free to download and use under the Apache 2.0 licence
- Installers for Windows and builds for Linux and macOS
- Keyword search, hash lookup, web and email artefact extraction, EXIF and media review
- Timeline view and report generation
- Extensible through user-written modules
- Cyber Triage add-ons for malware scanning and import
Technical limitations
- Processing is slower than the leading commercial tools on very large images
- Mobile support is limited to what a module can parse from a file system; it does not extract phones
- The maker says it is fully tested on Windows, so Linux and macOS users should expect rough edges
- Community support rather than a vendor helpdesk
- A court may ask the examiner to explain the tool's method, which open source makes possible but also makes the examiner's duty
Learning with DFRTI
Independent professional education covering the principles and workflows of Autopsy. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- What a disk image is and how it is verified
- Windows file system and artefact basics
Disciplines
Related tools
- The Sleuth KitThe Sleuth Kit, usually written TSK, is a C library and a set of command line tools for examining disk images and file systems. Autopsy is its graphical face. Working with TSK directly teaches what the graphical tools hide.Sleuth Kit Labs
- Exterro FTK ImagerFTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.Exterro
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- OpenText Forensic (EnCase)EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.OpenText
- X-Ways ForensicsX-Ways Forensics is the German examination tool that runs light, starts fast and gives the examiner the raw disk alongside the parsed view. Version 21.9 was current when this page was checked.X-Ways Software Technology AG
- OSForensicsOSForensics is PassMark's Windows examination suite. It indexes and searches a drive or image, recovers deleted files, uncovers user activity and keeps everything in a case file, with a free edition for learning and paid editions for full use.PassMark Software
- PlasoPlaso pulls every timestamp it can recognise out of a disk image or folder and writes them to one storage file. Sorted, that file is the super timeline investigators use to see what happened in what order.log2timeline project
- TimesketchTimesketch is a web application where several analysts work on the same timeline. Events from Plaso or CSV go into a sketch and the team searches, tags, comments and builds its account of events from them.Google (open source project)
Courses that cover this tool
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.
StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.
LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.Related reading
- SSDs, TRIM and What Happens to Deleted DataOn a hard disk a deleted file usually sits where it was until something overwrites it. On an SSD the drive itself may clear it within minutes. This explainer covers TRIM, garbage collection and wear levelling, what a forensic image of an SSD really contains and why file carving so often comes back empty.Explainer
- Hash Verification in Digital EvidenceA hash value is the one number that lets a court trust that the copy examined is the copy seized. This tutorial covers which algorithms to use and why, when to hash, how hash sets work, how to verify an image against its source and how to write hashes into the chain of custody and the report, with a worked synthetic example.Technical tutorial
Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.