Autopsy

sleuth
Primary Use Case
Tool Type
Cost Model
Free
Best For
Full computer forensics examinations on disk images and attached media
Investigators who want a free, open-source primary forensic suite
Keyword search, hash analysis, timeline review, and deleted-file recovery workflows
Academic, training, and research environments that benefit from transparent tooling
Teams that want an extensible platform with add-on modules and custom module options
Validation or secondary review alongside commercial forensic tools
Not Ideal For
Locked-device mobile access or phone unlocking workflows
Cloud-first or remote endpoint collection as the primary mission
Enterprise review portals where non-technical stakeholders need browser-based collaboration
Video-forensics-heavy cases where specialized DVR/CCTV tools are the main need
Labs that need turnkey premium support and polished commercial workflow out of the box

Autopsy logo

Autopsy is a free, open-source digital forensics platform designed to support end-to-end forensic examination of digital media. It is built for investigators who need a full examination suite for disk images and other digital evidence without the cost barrier of commercial software.

The official site positions Autopsy as a primary forensic tool and emphasizes its core workflow around adding data sources, running ingest modules, reviewing results, performing keyword and hash analysis, building timelines, and producing reports. The platform also supports add-on modules and third-party extensions, which expand it into areas such as video triage, law-enforcement hash matching, and other specialized workflows.

Autopsy is strongest when the need is a broad, extensible forensic workstation for hard-drive and general digital-media analysis. It is not the right listing for locked mobile access, cloud-first remote acquisition, or premium commercial workflow polish as the main buying priority.

```
 Autopsy is a free, open-source forensic suite from Sleuth Kit Labs for full examination of disk images and other digital media, with strong core support for artifact parsing, keyword and hash analysis, timelines, reporting, and extensibility through modules. 

Main Menu