Autopsy
Sleuth Kit Labs · Autopsy 4 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.
Who it is for, and when
Autopsy is where many examiners start a dead-box examination of a Windows or Linux disk image: mount the image, run ingest, and work through file system contents, deleted files, browser history, and registry-derived artefacts in one case. It is the standard free answer when a commercial licence is not available, and it is good for teaching and for corroborating a commercial suite's findings with an independently written tool. The case-and-report structure is adequate for producing exhibits.
What it does not cover
Autopsy is an analysis platform, not an acquisition tool, and it has no write-blocking of its own — you still need a hardware blocker or a verified imaging step upstream. Its mobile and cloud coverage is thin compared with a paid mobile suite, and large multi-terabyte cases will expose its performance limits well before a commercial processing engine does.
Go to the source
Open at sleuthkit.org (opens in a new tab)https://sleuthkit.org/autopsy/docs/user-docs/latest/
Details
- Type
- Tool
- Written for
- New to the fieldWorking examinerNew to the field, Working examiner
- Publisher
- Sleuth Kit Labs
- Version verified
- Autopsy 4
- Year
- 2026
- Topics
- file-systems, windows, triage, timeline, open-source, reporting
- Checked at source
Related entries
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
X-Ways Forensics
PaidA commercial Windows forensic examination environment from the German publisher X-Ways Software Technology AG, built on their WinHex disk editor and known for running from a portable installation with very low overhead. Licences are perpetual and protected by a local or network dongle, or by a bring-your-own-device arrangement.
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.
Case-driven walkthroughs of Windows examinations where the narration is the analyst's thought process: what question is being asked, which artifact is chosen next, and why a hypothesis was dropped. Deliberately excludes the artifact reference material from the author's other books.