The Autopsy Forensic Browser is a graphical interface to command line forensics tools and standard UNIX utilities. It allows you to perform volume and file system analysis on UNIX and Windows systems.

All data are saved in a directory in the Evidence Locker, which was specified at install time or at run time. See Case Management for more information. In the normal mode, Autopsy imports an image file from a disk or partition. In the live mode, Autopsy can analyze a running system and does not save any data to the local disk.

The browser has the following modes:

• Files: Allows you to browse the image file as a file system and view the contents of files and directories. This mode even shows deleted file names and Alternate Data Streams in NTFS images. You can sort the files and directories on meta data.
• Meta Data: Allows you to analyze the image file by examining the meta data structures. The address of a structure is entered and the details are shown. This mode is useful for examining unallocated structures and getting all details about allocated files (including all data units and other information such as MD5 value).
• Data Unit: Allows browsing by block number. This is most useful when used with searching or meta data browsing. The contents of the block can be displayed in ASCII, hex dump, or through strings(1). The meta data structure that has allocated the block will be displayed (if any) along with the file name (if any).
• Keyword Search : Search an image file using grep(1) for a given string or regular expression. The result will be a list of data units that have the string. Each data unit can be selected to view the contents.
• Image Details: List the details about the file or volume system. The output of this mode depends on the file system. Examples of the file system data include the last mount time, the last mount location, and a detailed break down of block group information or File Allocation Table contents.
• Image Integrity: The integrity of the data can be validated at any point by selecting this mode. It uses the values in md5.txt to identify if any data have been modified in the analysis process.
• File Activity Timelines: Autopsy can create timelines of file activity based on the Modified, Access, and Change (Create in FAT/NTFS) times (MAC). The timeline will contain details about deleted and allocated content. The resulting timeline can be either viewed within Autopsy or using other text viewing tools (WARNING: many HTML browsers do not handle large tables like a timeline very well so using a text editor is recommended).
• File Type Categories: Autopsy can sort the files in an image file based on their file type. For example, all JPEG and GIF files would be identified as images and all executable files would be identified. This mode will also ignore files that are found in hash databases of known good files, identify files that are found in a hash database of known bad files, and identify files that have an extension that is not consistent with their file type.
• Report Generation: Each of the above browsing techniques allows a report to be generated. This report lists the date, md5 value, investigator, and other context information in a text format. This can be used for record keeping when deleted blocks of data have been found.