Module output folder – Default location for modules to write output to.Ī data source the thing you need to examine.Reports folder – Default location to store reports.Export folder - Default location to store exported files.Autopsy.db – SQLite database will store basic case information and data source information.Note: In a Multi-user cluster, all examiners need to have access to the case directory at the same path. Either it has a notion of a ‘base’ directory or it makes a folder in the base directory with the case name. The 'File', 'Create New Case' menu itemĮach Autopsy case (Multi and Single user) has a directory.The opening splash screen has a button to create a new case.There are several ways to create a new case: The fundamental Autopsy case configuration file has an '.aut' augmentation. The index will contain configuration files, a database, reports, and different records that modules create. It's up to you how many cases you create: either it may be by investigation or by host within an investigation.Įach case has its own index (directory) that is named dependent on the case name. The data sources can be from various drives in a solitary PC or from numerous PCs.Ī case groups the investigation data you are going to analyze. Launch Autopsy and enable the central repository using a SQLite data base in the default App data location.Ī case can contain at least information sources (disk image, disk devices and logical files). There are other things to setup on a new installation: hash sets, keywords etc. Run “unix_setup.sh” to copy files into Autopsy.

Download “.zip” file of Autopsy and expand.

Install dependencies using package management tool.

You can have multiple versions of Autopsy installed at the same time.

Step 3: It will install in a version-specific folder. It can use the same server for multi-user cases.Īutopsy needs to be installed on an examiner’s computer (or Virtual machine). It can be used by multiple users at a time.

(ii) PostgreSQL – Database is stored on a server.

It can be used by only one user at a time.

(i) SQLite – It requires no other installations.

It keeps databases smaller and easier to manage. It contains MD5 hash values, comments and wifi SSIDs.Īutopsy typically has case-specific databases. In this case, Database that stores data from past cases.

Best mobile forensic software