Autopsy is a digital forensics platform with a graphical interface, built to examine what is stored on a hard drive, a USB stick or a phone. It acts as a visual front end to The Sleuth Kit, a set of command line tools created by Brian Carrier, and brings a wide range of analysis modules together around it. The software is released under the Apache 2.0 license and its code is hosted on GitHub.
Development is led by Sleuth Kit Labs, a company headed by Brian Carrier. According to its website, the team spent more than fifteen years inside Basis Technology before becoming an independent business in October 2023. The release history dates the first Autopsy 3 beta to August 2011 and version 4.0, which introduced multi-user cases, to November 2015.
What Autopsy is for
You start by opening a case and adding data sources to it: a raw or EnCase (E01) disk image, a VMDK or VHD virtual disk, a drive attached to the computer, a set of loose files or an export from the XRY mobile extraction tool. Autopsy then runs ingest modules in the background and posts their findings as they arrive, so an examiner can start reviewing early results without waiting for processing to finish.
Those modules handle most routine examination tasks. They identify a file’s real type, flag misleading extensions, compare hashes against known file sets, pull browser history and cookies, parse the Windows registry, read EXIF metadata from photos, recover deleted files with PhotoRec and apply YARA rules, a tool also covered in our software library. Others extract Android and iOS artifacts, decode DJI drone logs or assemble a full timeline of events.
Several views then help make sense of the results: an image gallery, a timeline, a map of geographic locations and a tool that charts communications between contacts. Teams can work on the same case through a multi-user mode backed by network services. Version 4.23.0 added a Windows-only MCP server, which the documentation describes as an integration with Claude Desktop.
Autopsy complements Volatility, which we also cover: one deals with storage, the other with live memory. The documentation even lists, among its experimental features, a module that processes a memory image with Volatility.
Who is it for?
The publisher says tens of thousands of law enforcement and corporate investigators use Autopsy around the world. It also suits incident response teams, internal auditors and students, who get a free way to learn forensic methodology without buying a commercial suite.
It is a demanding program. The documentation recommends at least 16 GB of RAM. The publisher also advises excluding case folders from antivirus and EDR software, which can slow processing dramatically or quarantine results. Autopsy is still designed with Windows first in mind: on Linux and macOS several modules are missing, including Recent Activity and mobile analysis. Since the move to The Sleuth Kit 4.14.0, XFS and Btrfs file systems are no longer supported.
Download Autopsy safely
The download page on autopsy.com points to files published on GitHub by the sleuthkit/autopsy project. Version 4.23.1, released on May 7, 2026, comes as a 64-bit MSI installer for Windows of about 1.2 GB and as a zip archive for Linux and macOS, each with a PGP signature for integrity checks. On Linux and macOS, setup relies on scripts that require Java 17 and The Sleuth Kit’s Java library. A snap package published by Sleuth Kit Labs is also available, although it still showed version 4.22.1 when we checked.
Autopsy itself costs nothing. Alongside it, Sleuth Kit Labs sells Cyber Triage, which can be evaluated for seven days, plus add-on modules, training, support and custom development. Since examiners handle evidence that may end up in court, the installer should come from these official addresses and its signature is worth verifying.
Frequently asked questions
Is Autopsy really free?
Yes. It is distributed under the Apache 2.0 license with no time limit and no locked features. Only the related products and services from Sleuth Kit Labs, such as Cyber Triage, training and support, are paid.
How does Autopsy differ from The Sleuth Kit?
The Sleuth Kit is a collection of command line tools and a library that read file systems. Autopsy builds on that library and adds a graphical interface, analysis modules, case management and reporting.
Does Autopsy run on a Mac?
Yes, using the zip archive and installation scripts that rely on Homebrew. Some features remain Windows-only, however, and the documentation notes that VHD and VMDK virtual disks are not supported on macOS.
