Overview

Autopsy allows you to conduct a digital forensic investigation. It is a graphical interface to The Sleuth Kit and other open source tools. This page outlines the basic concepts of the program. The remainder of the help guide is organized around these concepts.

All data is organized around the concept of a case. A case can have one or more disk images loaded into it.

The main window has three major areas:

• Data Explorer Tree: This area is where you go find major analysis functionality. It allows you to start finding the relevant files quickly.
• Result Viewers: This area is where the files and directories that were found from the explorer window can be viewed. There are different formatting options for the files.
• Content Viewers: This area is where file content can be viewed after they are selected from the Result Viewer area.

The main take away from this should be that analysis techniques and result categories can be found on the left-hand side, the results from choosing something on the left are always listed in the upper right, and the file contents are displayed in the lower left.