Autopsy is a digital forensics platform that provides a graphical interface to The Sleuth Kit and other open source forensics tools for investigating computer systems and recovering data.
The tool addresses the need for accessible digital forensics investigation by wrapping command-line forensics utilities in a user-friendly interface. It bundles The Sleuth Kit for disk image analysis, Solr for keyword searching, GStreamer for video playback, Regripper for Windows registry analysis, and other specialized tools into a single application. Autopsy 4 added multi-user collaboration capabilities, allowing multiple examiners to work on the same case simultaneously.
The platform is designed for law enforcement, military, and corporate investigators, as well as individuals recovering data from storage devices like camera memory cards. It is built as a cross-platform Java application, though the tool is fully functional and tested only on Windows. The Windows installer bundles all dependencies, eliminating manual setup of individual forensics tools. Users should be aware that the tool requires the Java Runtime Environment and the NetBeans RCP platform, both included in the Windows distribution. The built-in help system and QuickStart Guide provide documentation for getting started.
Development activity shows consistent maintenance with bug reports and feature requests directed to the sleuthkit-users mailing list. The project maintains integration with multiple external forensics tools and libraries, indicating ongoing effort to keep those dependencies current and functional. The codebase remains actively supported for Windows environments while acknowledging limitations on other operating systems.
