Autopsy - Cyber Forensic Browser in Kali Linux

Last Updated : 8 Aug, 2026

Autopsy is a premier open-source digital forensics platform and graphical interface used to investigate hard drives, smartphones and disk images. It serves as the graphical front-end for The Sleuth Kit (TSK), a collection of command-line tools, making comprehensive forensic analysis accessible through an intuitive, user-friendly workspace. Key Capabilities:

  • Comprehensive File Recovery: Extracts deleted files, unallocated space contents and hidden partitions.
  • Automated Artifact Parsing: Extracts web browser history, emails, cookies and system registry data automatically.
  • Timeline Analysis: Creates a central, chronological view of system events to reconstruct user activity.
  • Keyword & Hash Search: Scores files against known MD5/SHA-256 hash databases (like the NSRL) to flag malware or ignore safe system files.
  • Extensible Framework: Supports third-party modules and plugins to add custom analysis features.

Installation of Autopsy

Execute the below command in the terminal for installing the Autopsy browser on the Linux system.

sudo apt-get install autopsy

Step 1: Usage of Autopsy Browser

Opening Autopsy by typing the command in the terminal.

  • Click on Applications in Kali Linux
  • Search for autopsy
  • Enter the password in autopsy(root)
 

Autopsy displays its built-in usage information:

autopsy -h

/usr/bin/autopsy is the command to use.

[-c][-C][-d evid_locker][[-i device filesystem mnt][-p port][remoteaddr]
  • -c: in the URL, force a cookie.
  • -C: No cookies are allowed in the URL.
  • -i device filesystem mnt: provide the evidence locker directory.
  • -d dir: specify the evidence locker directory.
  • -p port: provide the port of the server (default: 9999).
  • remoteaddr: use the browser to provide the host (default: localhost).

Step 2: Launching Autopsy through the browser

Click on the link of localhost from the autopsy shell to launch autopsy in the default browser.

 

Now, we will select the name from the list. Here, we have selected the name Sudo.

 

Step 3: Adding Host

  • Start a new case.
  • Add a new host or select any previously created firewall.
 

Step 4: Adding Image

After creating the host, upload the image of the drive(generally have an extension of .dd).

Step 5: Analyzing Files

After this click on FILE ANALYSIS.

Comment

Explore