Autopsy on Windows

Much easier, spin up a windows VM, and install autopsy. Works out of the box.



Before diving into Autopsy and analysing data, some steps are to be taken; such as identifying the data source and what Autopsy actions to do with the data source.

Basic workflow:

  • Create/open a case for the data source to investigate

  • Select the data source to analyse

  • Configure the ingest modules to extract specific artefacts from the data source

  • Review the artefacts extracted by the ingest modules

  • Create the report

New Case

To prepare a new case investigation, you need to create a case file from the data source. When you start Autopsy, there will be three options. You can create a new case file using the “New Case” option. Once you click on the “New Case” option, the Case Information menu opens, where information about the case is populated.

Autopsy New Case

  • Case Name: The name you wish to give to the case

  • Base Directory: The root directory that will store all the files specific to the case (the full path will be displayed)

  • Case Type: Specify whether this case will be local (Single-user) or hosted on a server where multiple analysts can review (Multi-user)

DFIRScience offers two YouTube mini courses to quickly get started, respecting common DFIR practices: