Autopsy ® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera’s memory card.



autopsy [-c] [-C] [-d evid_locker] [-i device filesystem mnt] [-p port] [remoteaddr]


  -c: force a cookie in the URL
  -C: force NO cookie in the URL
  -d dir: specify the evidence locker directory
  -i device filesystem mnt: Specify info for live analysis
  -p port: specify the server port (default: 9999)
  remoteaddr: specify the host with the browser (default: localhost)


Autopsy requires a directory name Evidence_Locker. This is where the Case evidence is stored, and many other files to make Autopsy work properly.

cyborg@cyborg:~$ mkdir Documents/Evidence_Locker

Start Autopsy.

cyborg@cyborg:~$ autopsy -d /home/cyborg/Documents/Evidence_Locker/


                       Autopsy Forensic Browser 
                             ver 2.24 

Evidence Locker: /home/cyborg/Documents/Evidence_Locker
Start Time: Tue Oct 27 12:30:59 2015
Remote Host: localhost
Local Port: 9999

Open an HTML browser on the remote host and paste this URL in it:


Keep this process running and use <ctrl-c> to exit

Open the given link in Browser :

autopsy Autopsy

Make A  New Case :

autopsy new case Autopsy



Case Create , Now click on Add Host:

autopsy case created Autopsy



Fill The Details of the Host :

autopsy host Autopsy



Add Image to the case :

autopsy image Autopsy


Leave a reply


We're are building as a community and a team. Be a part of it.


©2018 Ztrela Knowledge Solutions Pvt. Ltd

Log in with your credentials

Forgot your details?