Autopsy
Autopsy is an open-source digital forensics platform built on The Sleuth Kit. It provides investigators with a graphical interface to analyze hard drive images, memory dumps, and mobile backups, enabling timeline reconstruction, deleted file recovery, and browser activity analysis.
github.com · Official website
- ✓ Official source (winget)
- ✓ SHA256 taken from the official repository
- ✓ Last checked: Nov. 4, 2026
- This is not a virus scan. Check on VirusTotal
- Version
- 4.23.1
- Release date
- May 7, 2026
- License
- Apache License 2.0
- Installer type
- msi
How do I use this?
Type Terminal in the Start menu and open it, paste the command (Ctrl+V or right-click) and press Enter. It uses winget, Windows' own package manager, to install the program from its official source.
winget install --id SleuthKit.Autopsy -eSHA256 (file verification)
f0f368e10cf615a805c85248356673a00c88a5e19c3b632859a1c98569ae03b6We couldn't find a macOS version of Autopsy in the official repositories; check the publisher's website.
You can try these instead:
We couldn't find a Linux version of Autopsy in the official repositories; check the publisher's website.
You can try these instead:
We couldn't find a Android version of Autopsy in the official repositories; check the publisher's website.
Platform pages: Windows · macOS · Linux · Android
Old versions (10)
Autopsy 4.23.1: what's new?
- Fixes an issue where version 4.23.0 was mistakenly published as a Develop build instead of a Release build.
- Restores access to settings that were previously unavailable.
Summarized from the publisher's release notes.
Highlights
- Comprehensive digital forensics analysis on raw and forensic disk images
- Keyword searching and automated hash set filtering
- Web artifact analysis for browser history, cookies, and downloads
- Graphical timeline analysis to track system and user activity
Who is it for?
Digital forensics examiners, incident response professionals, and law enforcement personnel analyzing digital media during investigations.
Good to know before installing
- Processing large image files demands significant CPU and memory resources.
- Mastering the ingest modules and forensic workflows involves a steep learning curve.
How to install
Windows
- Download the official installer using the download button on this page, or run winget install --id SleuthKit.Autopsy -e in your terminal.
- Open the installer and follow the on-screen setup prompts.
- Launch Autopsy once the installation completes.
Alternatives
- FTK Imager
- Volatility
- Wireshark
Frequently asked questions
Is Autopsy free for commercial use?
Yes, Autopsy is released under the Apache License 2.0 and is completely free for both personal and commercial use.
What disk image formats are supported?
It supports popular formats including Raw/DD, Expert Witness (E01), and virtual machine images such as VHD and VMDK.
Can Autopsy recover deleted files?
Yes, it parses file system metadata and file slack space to identify and extract unallocated or deleted files.