Turn disk images into visual evidence reports.
What it does
Analyzes forensic disk images with Autopsy and The Sleuth Kit to recover evidence and produce investigation timelines and visual reports.
When to use it
Use for structured disk-image investigations involving file recovery, keyword searches, timelines, or visual reports for non-technical stakeholders.
How to use it
Give it a forensic disk image; it analyzes the evidence and exports timelines and an HTML report to the computer.
What you provide
- Your files
Uses
NS
Latest review
What you need · 4
Lists Autopsy 4.x as required, with Windows and Linux installation configurations.
Requires JRE 8 or later for Autopsy.
Access · 5
This skill
GitHub
Read
Downloads an Autopsy release
NSRL
Read
Downloads known-software hash data