DFIROpen source · Apache-2.0
Autopsy
Community project
A free graphical forensics tool built on The Sleuth Kit for analyzing disk images, recovering deleted files, and building activity timelines. Brian Carrier created it, and Sleuth Kit Labs has maintained it since 2023.
Verified Source: 1
- Product type
- Community project
- Deployment
- On-prem
- Organization size
- IndividualSMBMid-market
- Pricing tier
- Free
Capability checklist
DFIRHow Autopsy measures up against the full Digital Forensics & Incident Response taxonomy.
- Endpoint & memory forensic acquisition — supported
- Captures disk, memory, and system artifacts for detailed forensic analysis.
- Timeline reconstruction — supported
- Rebuilds the sequence of attacker actions across affected systems.
- Malware analysis — not supported
- Analyzes malicious files to understand their behavior and origin.
- Incident response playbooks & retainer — not supported
- Provides pre-built response procedures and on-call expert support during a breach.
- Evidence chain-of-custody — not supported
- Maintains legally defensible handling of evidence for potential litigation.
- Root-cause & scope analysis — not supported
- Determines how an attacker got in and how far they reached.
Alternatives
Other Digital Forensics & Incident Response tools with overlapping capabilities, sized for similar teams.
Appears in stacks
Real-world stacks that include Autopsy.