Autopsy.

Autopsy is a free, open-source digital-forensics platform led by Brian Carrier and his team at Basis Technology / Sleuth Kit Labs. It serves as a graphical front end to The Sleuth Kit (TSK) and adds case management, automated ingest modules, keyword search, timeline analysis, hash sets (the NIST NSRL), web-artefact carving, EXIF metadata, registry parsing, Android forensics and a Python/Java plug-in API for custom modules. Originally released as a web-based tool in 2003, the modern Autopsy 4 line is a desktop application built on the Java NetBeans platform that runs on Windows, Linux and macOS.

The core workflow adds one or more data sources — a raw dd image, an Expert Witness E01, a virtual disk, or a live local drive — after which the case runs an ingest pipeline of modules in sequence: hash lookup (flagging known-bad and filtering known-good NSRL files), file-type identification, keyword indexing via an embedded Apache Solr engine, EXIF and web-history extraction, and data carving with PhotoRec. Results populate a tree of "interesting items," a full-text index, and a combined timeline that DFIR analysts pivot through. Because processing runs read-only against the image and every action is logged, findings can be reproduced and tied to chain-of-custody records — the reason Autopsy is a standard free counterpart to commercial suites such as FTK and EnCase and is often the first tool taught in academic computer-forensics courses.

flowchart TD
  A[Forensic image: dd / E01] --> B[Add data source to case]
  B --> C[Ingest pipeline]
  C --> D[Hash lookup vs NSRL / known-bad]
  C --> E[Keyword index - Apache Solr]
  C --> F[EXIF + web history]
  C --> G[Data carving - PhotoRec]
  D --> H[Interesting items + timeline]
  E --> H
  F --> H
  G --> H
  H --> I[Report + chain of custody]