Autopsy (software)

Autopsy is computer software that makes it simpler to deploy many of the open source programs and plugins used in The Sleuth Kit.^[1] The graphical user interface displays the results from the forensic search of the underlying volume, making it easier for investigators to flag pertinent sections of data. The tool is largely maintained by Basis Technology Corp. with the assistance of programmers from the community. The company sells support services and training for using the product.^[2]

The tool is built with the following principles:

Extensible: Users can add new functionality by creating plugins to analyze parts or all of the underlying data source.
Centralized: It provides a standard and consistent way to access all features and modules.
Ease of Use: The Autopsy Browser includes wizards and historical tools to help users repeat their steps without needing to reconfigure settings.
Multiple Users: Suitable for both individual investigators and teams working together.

The core browser can be enhanced with various modules that facilitate different tasks, such as scanning files, browsing results, and summarizing findings. A range of open-source modules is available for customization based on specific needs.

Autopsy tool can be used to recover WannaCry-infected data as well.^[3]

Process[edit]

Autopsy analyzes major file systems (NTFS, FAT, ExFAT, HFS+, Ext2/Ext3/Ext4, YAFFS2) by hashing all files, unpacking standard archives (ZIP, JAR etc.), extracting any EXIF values and putting keywords in an index. Some file types like standard email formats or contact files are also parsed and cataloged.

Users can search these indexed files for recent activity or create a report in HTML or PDF summarizing important recent activity. If time is short, users may activate triage features that use rules to analyze the most important files first. Autopsy can save a partial image of these files in the VHD format.

Correlation[edit]

Investigators working with multiple machines or file systems can build a central repository of data allowing them to flag phone numbers, email addresses, files, or other pertinent data that might be found in multiple places. The SQLite or PostgreSQL database stores the information so investigators can find all occurrences of names, domains, phone numbers, or USB registry entries.

Language[edit]

Version 2 of Autopsy is written in Perl and it runs on all major platforms including Linux, Unix, macOS, and Windows. It relies upon The Sleuth Kit to analyze the disk. Version 2 is released under the GNU GPL 2.0.^[4]

Autopsy 3.0 is written in Java using the NetBeans platform. It was released under the Apache license 2.0.^[4]

Autopsy 4.0 runs on Windows, Linux, and macOS.

Autopsy depends on a number of libraries with various licenses.^[4] It works phone with SQLite and PostgreSQL databases to store information. The indices for searching keywords are built with Lucene/SOLR.

References[edit]

^ "The Sleuth Kit (TSK) & Autopsy: Open Source Digital Forensics Tools". Brian Carrier.
^ "Digital Forensics". Basis Technology Corp. 23 December 2013.
^ S. C. Nayak, V. Tiwari and B. K. Samanthula, "Review of Ransomware Attacks and a Data Recovery Framework using Autopsy Digital Forensics Platform," 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, 2023, pp. 0605–0611, doi: 10.1109/CCWC57344.2023.10099169.
^ ^a ^b ^c "Autopsy: License". Brian Carrier.

External links[edit]

[1] "The Sleuth Kit (TSK) & Autopsy: Open Source Digital Forensics Tools". Brian Carrier.

[2] "Digital Forensics". Basis Technology Corp. 23 December 2013.

[3] S. C. Nayak, V. Tiwari and B. K. Samanthula, "Review of Ransomware Attacks and a Data Recovery Framework using Autopsy Digital Forensics Platform," 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, 2023, pp. 0605–0611, doi: 10.1109/CCWC57344.2023.10099169.

[lic-4] "Autopsy: License". Brian Carrier.

[1]