autopsy [-c] [-C] [-d evid_locker ] [-i device filesystem mnt ] [-p port ] [addr]
By default, autopsy starts the Autopsy Forensic Browser server on port 9999 and and accepts connections from the localhost. If -p port is given, then the server opens on that port and if addr is given, then connections are only accepted from that host. When the -i argument is given, then autopsy goes into live analysis mode.
The arguments are as follows:
When started, the program will display a URL to paste into an HTML browser. The browser must support frames and forms. The Autopsy Forensic Browser will allow an investigator to analyze images generated by dd(1) for evidence. The program allows the images to be analyzed by browsing files, blocks, inodes, or by searching the blocks. The program also generates Autopsy reports that include collection time, investigators name, and MD5 hash values.
The following variables can be set in conf.pl.
# autopsy -p 8888 10.1.34.19
dd(1), fls(1), ffind(1), ifind(1), grep(1), icat(1) md5(1), strings(1),
The Autopsy Forensic Browser requires The Sleuth Kit <www.sleuthkit.org/sleuthkit>
autopsy first appeared in Autopsy v1.0.
This software is distributed under the GNU Public License.
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>