Autopsy

Autopsy is a handy forensic tool that helps you analyze raw or E01 disk images, as well as local drives and directories. It's great for figuring out what might have caused an event to happen. This application supports different file systems like NTFS, FAT, HFS, Ext2, Ext3, and UFS. So whether you're dealing with IMG, DD, 001, AA, RAW files or local disks, Autopsy has got your back. Plus, it can whip up complete reports in HTML, XLS, TXT format or even a TSK body file to help create an event timeline.

Easy Case Creation

Thanks to its built-in wizards, starting a new 'case' is super easy—just click 'Next' a few times! You'll find multiple analysis modules to choose from: the app can show recent actions taken on the system, perform hash lookups to spot malware files and other issues that need your attention. You can also extract archives and parse EXIF data from images.

Real-Time Results

One of the coolest things about Autopsy is its ingest method. This means you don't have to wait forever for results; you'll get analysis outcomes as they come in! While it's working through the data, download Autopsy, so you can jump right into action!

Hash Lookup Operations

The hash lookup feature is designed to detect malware files by checking against various formats. This helps identify issues quickly by looking at the NSRL database format and EnCase hashset files while ensuring everything meets HashKeeper standards.

Keyword Search Module

The keyword search module uses Apache SOLR to help you define relevant strings and supports regular expressions too. It's super useful when you're sifting through tons of data.

Extracting Useful Information

You can also use Autopsy for extracting URLs from browsers, viewing installed applications, analyzing the registry, or even pulling out email addresses and device IDs connected to your system.

Create Event Timelines

If you're looking to piece together what happened during an incident, Autopsy processes disk images or directories effectively. It's all about helping you connect the dots and understand how things went down!