Digital forensics platform built on The Sleuth Kit
Graphical digital forensics platform that analyses disk images and devices with The Sleuth Kit, with modules for timelines, keyword search and artefacts.
Autopsy gives investigators a desktop interface to examine disk images, local drives and logical files. Ingest modules extract web history, email, registry data, EXIF metadata and deleted files, and a timeline view and keyword search help reconstruct events.
It is the graphical front end of The Sleuth Kit project and is used by law enforcement, corporate investigators and incident responders.
Apache-2.0 · Apache License 2.0 · Open source
GitHub does not report a licence; the repository's LICENSE-2.0.txt is the Apache 2.0 text.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub does not report a licence.
No published advisory found for Autopsy in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
Memory forensics framework
Framework for extracting digital artefacts from memory images (RAM dumps) of Windows, Linux and macOS systems, rewritten in Python 3.
Super timeline creation for forensic analysis
Python engine that extracts timestamps from hundreds of file and log formats on a disk image and merges them into one forensic super timeline.
Endpoint visibility and digital forensics at scale
DFIR tool that collects forensic artefacts and hunts across fleets of endpoints with its query language VQL, from a single server binary.
UNIX-like reverse engineering framework
Command-line reverse engineering framework with a disassembler, debugger, hex editor and scripting for many architectures and file formats.
Query your endpoints with SQL
Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.
Network protocol analyser
The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.
