AUTOPSY(1)

💖 AUTOPSY(1) — the Autopsy Forensic Browser, bestie edition 💖

okay so welcome to the manual for autopsy, aka the Autopsy Forensic Browser — the group chat for your forensic images. this is from the General Commands Manual and honestly she ate. 🎀

---

✨ SYNOPSIS ✨

autopsy [-c] [-C] [-d evid_locker ] [-i device filesystem mnt ] [-p port ] [addr]

---

🌸 DESCRIPTION 🌸

no cap, here's the vibe: by default autopsy starts up the Autopsy Forensic Browser server on port 9999 and only accepts connections from the localhost. like, she's shy, she stays home. 💅

• if -p port is given, the server opens on that port instead.
• if addr is given, connections are only accepted from that host.
• when the -i argument is given, autopsy goes into live analysis mode (main character energy fr).

the arguments are as follows:

• -c — forces the program to use cookies even for localhost. 🍪
• -C — forces the program to not use cookies even for remote hosts.
• -d evid_locker — directory where cases and hosts are stored. this overrides the LOCKDIR value in conf.pl. the path must be a full path (i.e. start with /). no shortcuts bestie.
• -i device filesystem mnt — specify the info for live analysis mode. this can be specified as many times as needed. the device field is for the raw file system device, the filesystem field is for the file system type, and the mnt field is for the mounting point of the file system.
• -p port — TCP port for server to listen on.
• addr — IP address or host name of where the investigator is located. > heads up: if localhost is used, then localhost must be used in the URL. if you use the actual hostname or IP, it will be rejected. 💀

when started, the program will display a URL to paste into an HTML browser. the browser must support frames and forms (yes, frames, we love a retro moment). The Autopsy Forensic Browser will allow an investigator to analyze images generated by dd(1) for evidence. the program allows the images to be analyzed by browsing files, blocks, inodes, or by searching the blocks. the program also generates Autopsy reports that include collection time, investigator's name, and MD5 hash values. iconic behavior honestly. 👑

---

🦋 VARIABLES 🦋

the following variables can be set in conf.pl:

• USE_STIMEOUT — when set to 1 (default is 0), the server will exit after STIMEOUT seconds of inactivity (default is 3600). this setting is recommended if cookies are not used. like, please turn this on if you're cookieless, she needs a nap time. 😴
• BASEDIR — directory where cases and forensic images are located. the images must have simple names with only letters, numbers, '_', '-', and '.'. (see FILES). no fancy characters, she's picky. 🎀
• TSKDIR — directory where The Sleuth Kit binaries are located.
• NSRLDB — location of the NIST National Software Reference Library (NSRL).
• INSTALLDIR — directory where Autopsy was installed.
• GREP_EXE — location of grep(1) binary.
• STRINGS_EXE — location of strings(1) binary.

---

🎀 FILES 🎀

• Evidence Locker — the Evidence Locker is where all cases and hosts will be saved to. it is a directory that will have a directory for each case. each case directory will have a directory for each host. it's giving nesting dolls but make it forensics. 🪆
• <CASE_DIR>/case.aut — this file is the case configuration file for the case. it contains the description of the case and default subdirectories for the hosts.
• <CASE_DIR>/investigators.txt — this file contains the list of investigators that will use this case. > these are used for logging only, not authentication. so don't go thinking it's a password file, bestie. 🙈
• <HOST_DIR>/host.aut — this file is where the host configuration details are saved. it is similar to the 'fsmorgue' file from previous versions of Autopsy. it has an entry for each file in the host and contains the host description.
• md5.txt — some directories will have this file in it. it contains MD5 values for important files in the directory. this makes it easy to validate the integrity of images. integrity check slay. ✨

---

💜 EXAMPLE 💜

# autopsy -p 8888 10.1.34.19

---

🌈 SEE ALSO 🌈

dd(1), fls(1), ffind(1), ifind(1), grep(1), icat(1) md5(1), strings(1),

---

⭐ REQUIREMENTS ⭐

The Autopsy Forensic Browser requires The Sleuth Kit <www.sleuthkit.org/sleuthkit> 🧚

---

🍓 HISTORY 🍓

autopsy first appeared in Autopsy v1.0. a true og. 👑

---

💅 LICENSE 💅

this software is distributed under the GNU General Public License.

---

🫶 AUTHOR 🫶

Brian Carrier <carrier at sleuthkit dot org>

send documentation updates to <doc-updates at sleuthkit dot org>

---

and that's the whole page, periodt. 💖 this one's from the User Manuals, dated MAR 2005 — shoutout to the vintage era, she's still serving. 🎀✨