Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
Java Python Other
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
Core Merge pull request #4042 from dannysmyda/4084-sqlite-public-api Aug 16, 2018
CoreLibs Module version updates for release 4.8.0 Jul 30, 2018
Experimental Merge branch 'develop' of https://github.com/sleuthkit/autopsy into l… Aug 10, 2018
ImageGallery Module version updates for release 4.8.0 Jul 30, 2018
InternalPythonModules Fix string format of error message Jul 12, 2018
KeywordSearch Revert "4067 prevent duplicate keyword hits" Aug 20, 2018
RecentActivity Module version updates for release 4.8.0 Jul 30, 2018
ScalpelCarver Merge pull request #3348 from zhhl/3386-changeFilePermission Jan 8, 2018
Testing modified travis for reduced verbosity and added appveyor.yml Apr 13, 2018
branding Add dummy GSTVideoPanel class for VT backwards compatibility Jun 25, 2018
developers 3386: Update the files permission from 755 to 644 Jan 3, 2018
docs Update common files docs Jun 28, 2018
icons 3386: Update the files permission from 755 to 644 Jan 3, 2018
installer_autopsy removed comment from installer Nov 3, 2014
nbproject Change build type back to DEVELOPMENT Aug 1, 2018
pythonExamples delete the report file if ingestprocesscancelled in runexe.py Jun 12, 2018
test 3908: Use correct file url Jun 15, 2018
thirdparty 3845 rever open cv library files Jun 21, 2018
thunderbirdparser Module version updates for release 4.8.0 Jul 30, 2018
unix validate user input in launch_bootable_Script Aug 6, 2018
.gitattributes 3386: Update the files permission from 755 to 644 Jan 3, 2018
.gitignore Keep case directory when test fails. May 18, 2018
.travis.yml added python script to setup sleuthkit branch in appveyor and travis May 9, 2018
API-CHANGES.txt 3386: Update the files permission from 755 to 644 Jan 3, 2018
BUILDING.txt 3386: Update the files permission from 755 to 644 Jan 3, 2018
BootstrapIvy.xml 3386: Update the files permission from 755 to 644 Jan 3, 2018
LICENSE-2.0.txt 3386: Update the files permission from 755 to 644 Jan 3, 2018
NEWS.txt upated NEWS Aug 8, 2018
README.txt 3386: Update the files permission from 755 to 644 Jan 3, 2018
README_LINUX_OSX.md 3386: Update the files permission from 755 to 644 Jan 3, 2018
Running_Linux_OSX.txt modified mac os X docs Aug 14, 2018
TSKVersion.xml Update TSKVersion.xml Jul 19, 2018
appveyor.yml added python script to setup sleuthkit branch in appveyor and travis May 9, 2018
build-unix.xml 3386: Update the files permission from 755 to 644 Jan 3, 2018
build-windows-installer.xml 3386: Update the files permission from 755 to 644 Jan 3, 2018
build-windows.xml 3386: Update the files permission from 755 to 644 Jan 3, 2018
build.xml Merge pull request #3748 from esaunders/custom-release-may-2018 May 8, 2018
git-daemon-export-okay 3386: Update the files permission from 755 to 644 Jan 3, 2018
ruleset.xml update PMD rules May 15, 2018
setupSleuthkitBranch.py Updated comments. May 11, 2018
unix_setup.sh restrict binary permission Aug 8, 2018
update_versions.py 3386: Update the files permission from 755 to 644 Jan 3, 2018

README.txt

Autopsy 4
http://www.sleuthkit.org/
March 15, 2016


OVERVIEW

Autopsy is a graphical interface to The Sleuth Kit and other open source digital forensics tools. 
Autopsy 3 was a complete rewrite from Autopsy 2 to make it Java-based.
Autopsy 4 improves on Autopsy 3 by supporting collaboration on a single case by multiple users.     

Although Autopsy is designed to be cross-platform (Windows, Linux, MacOSX), the current version is fully functional and fully tested only on Windows. 
We have run it on XP, Vista, and Windows 7 with no problems. 

Autopsy 4 is released under the Apache 2.0 license.
Some libraries Autopsy uses may have different, but similar, open source licenses. 


INSTALLATION

For a Windows installation, all Autopsy dependencies are bundled with the installer provided.
There is no need for manual installation of additional dependencies if the Windows installer is used.

If you want the Japanese localized version, you must have the Japanese language pack (http://support.microsoft.com/kb/972813) installed and the default locale set to JA. (http://windows.microsoft.com/en-us/windows/change-system-locale#1TC=windows-7).

Refer to the KNOWN_ISSUES.txt file for known bugs that could cause investigation problems. 


SUPPORT

There is a built-in help system in Autopsy once you get it started.  There is also a QuickStart Guide that comes with the installer.

Send any bug reports or feature requests to the sleuthkit-users e-mail list.
    http://www.sleuthkit.org/support.php


LICENSE

The Autopsy code is released under the Apache License, Version 2.  See LICENSE-2.0.txt for details.


EMBEDDED SOFTWARE

This section lists the software components and libraries that are used by 
Autopsy.   These tools are bundled with the Windows installer, unless specified otherwise.

JRE (Java Runtime Environment) 1.8
- Web page: http://www.oracle.com/technetwork/java/index.html
- License: http://www.oracle.com/technetwork/java/javase/terms/license/index.html

Netbeans 8.0.2 RCP platform and .jar files bundled with the platform
- Web page: http://netbeans.org/features/platform/
- License: https://netbeans.org/downloads/jdk-bundle/8.0.2/nb802-LICENSE.txt

Sleuth Kit for analyzing disk images.
- Web page: http://www.sleuthkit.org/sleuthkit/
- License: http://sleuthkit.org/sleuthkit/licenses.php

Libewf for opening E01 files
- Web page: https://github.com/libyal/libewf
- License: http://www.gnu.org/licenses/lgpl.html

zlib for opening E01 files
- Web page: http://zlib.net/
- License: http://zlib.net/zlib_license.html

Solr (including Lucene and TIKA) for keyword search
- Web page: http://projects.apache.org/projects/solr.html
- License: http://www.apache.org/licenses/LICENSE-2.0

GStreamer for viewing video files
- Web page: http://gstreamer.freedesktop.org/
- License: http://www.gnu.org/licenses/lgpl.html

GStreamer-java for viewing video files
- Web page: http://code.google.com/p/gstreamer-java/
- License: http://www.gnu.org/licenses/lgpl.html

Regripper for pulling recently activity
(Including custom plugins)
- Web page: http://regripper.wordpress.com/
- License: http://www.gnu.org/licenses/gpl.html

Pasco2 for pulling Internet Explorer activity
- Web page: http://sourceforge.net/projects/pasco2/
- License: http://www.gnu.org/licenses/gpl.html

Jericho for extracting content from HTML files
- Web page: http://jerichohtml.sourceforge.net/
- License: http://www.gnu.org/copyleft/lesser.html

Advanced installer 9 (Freeware)
(not embedded in Autopsy, but used to generate Autopsy installer.)
- Web page: http://www.advancedinstaller.com/

Metadata Extractor 2.6.2 for extracting Exif metadata
- Web page: http://www.drewnoakes.com/code/exif/
- License: http://www.apache.org/licenses/LICENSE-2.0

Reflections 0.9.8 for ingest module loading
- Web page: http://code.google.com/p/reflections 
- License: http://en.wikipedia.org/wiki/WTFPL

Sigar for process monitoring
- Web page: http://support.hyperic.com/display/SIGAR/Home
- License: http://support.hyperic.com/display/SIGAR/Home#Home-license

7Zip and 7Zip java bindings for 7Zip extractor module
- Web page: http://sevenzipjbind.sourceforge.net/
- License: http://sourceforge.net/directory/license:lgpl/

ImgScalr 4.2 for image resizing in image viewers
- Web page: http://www.thebuzzmedia.com/software/imgscalr-java-image-scaling-library/
- License: http://www.thebuzzmedia.com/software/imgscalr-java-image-scaling-library/#license

ControlsFX JavaFX GUI library
- Web page: http://fxexperience.com/controlsfx/
- License: https://bitbucket.org/controlsfx/controlsfx/src/default/license.txt?fileviewer=file-view-default

JFXtras JavaFX GUI library
- Web page: http://jfxtras.org/
- License: https://github.com/JFXtras/jfxtras#license

Mustache.java templating system
- Web page: https://github.com/spullara/mustache.java
- License: https://github.com/spullara/mustache.java/blob/master/LICENSE

Joda-Time date and time library
- Web page: http://www.joda.org/joda-time/
- License: http://www.joda.org/joda-time/license.html

TwelveMonkeys ImageIO plugins
- Web page: https://github.com/haraldk/TwelveMonkeys
- License: https://github.com/haraldk/TwelveMonkeys#license


EMBEDDED RESOURCES

This section lists other resources, such as icons, that are used by Autopsy.   

FAMFAMFAM Silk Icons v1.3
- Web page: http://www.famfamfam.com/lab/icons/silk/
- License: http://creativecommons.org/licenses/by/3.0/

Fugue Icons v3.5.6
- Web page: http://p.yusukekamiyamane.com/
- License: http://creativecommons.org/licenses/by/3.0/

WebHostingHub Glyphs
- Web page: http://www.webhostinghub.com/glyphs/
- License: http://creativecommons.org/licenses/by/3.0/

Splashy Icons (free as in free) 
- Web page: http://splashyfish.com/icons/