Autopsy: Digital Forensics & File Recovery

Had a client accidentally delete critical business files. Empty trash, backups were corrupted, typical disaster scenario. Needed something more powerful than basic recovery software.

That's when I properly explored Autopsy. It's a graphical interface for The Sleuth Kit, used by actual digital forensics investigators. The learning curve is steeper than consumer recovery tools, but you get access to professional-grade analysis capabilities.

What Autopsy actually does

Autopsy isn't just about hitting "recover" and hoping for the best. It analyzes disk images at multiple levels:

Installing Autopsy

Autopsy is cross-platform. The easiest method is downloading the platform-specific installer:

# macOS (Intel)
brew install --cask autopsy

# macOS (Apple Silicon)
# Download from sleuthkit.org/autopsy/downloads.php

# Linux (Ubuntu/Debian)
sudo apt-get install autopsy

# Windows
# Download installer from sleuthkit.org

Note: Autopsy requires Java 11 or later. Most installations include it, but you might need to install it separately on Linux.

Creating a disk image (important first step)

Before analyzing anything, you need to create a disk image. Never work directly on the original drive - you risk overwriting the data you're trying to recover.

# On macOS/Linux - create a bit-for-bit copy
dd if=/dev/disk2 of=evidence.img bs=4M conv=noerror,sync status=progress

# Split into chunks if the image is huge
dd if=/dev/disk2 | split -b 4G - evidence.img.

# On Windows - use FTK Imager (free) or similar
# Or via WSL
wsl dd if=/dev/sdb of=/mnt/c/evidence.img bs=4M conv=noerror,sync status=progress

Why this matters: Working on a copy preserves the original evidence and prevents accidental data loss. In professional forensics, this is standard practice.

Creating a new case

Launch Autopsy and create a new case:

1. Click "New Case" and give it a name and case number
2. Choose a location for case data (needs space for extracted files)
3. Add a data source - select your disk image file
4. Choose ingest modules (more on this below)
5. Let it run the initial analysis

The initial analysis can take a while depending on drive size. For a 500GB drive, expect anywhere from 30 minutes to several hours.

Understanding ingest modules

Ingest modules are analysis plugins that run automatically. Here's what I typically enable:

Tip: For quick recovery, skip the slower modules initially. You can always run them later.

Navigating the interface

Once analysis completes, you'll see several views:

• Tree View: Browse by directory structure, including deleted files
• File Types: Grouped by extension (JPG, PDF, DOCX, etc.)
• Deleted Files: Only shows files marked as deleted
• Results: Output from ingest modules (web history, emails, etc.)
• Timeline: Chronological view of file activity

Recovering deleted files

Here's the workflow I use for deleted file recovery:

1. Go to "Deleted Files" view
2. Sort by "Path" or "File Type" to narrow down
3. Use filters to show only specific file types
4. Right-click files and "Extract" to save them
5. For multiple files, select them and extract to a folder

# Extraction creates this structure:
case_name/
├── exports/
│   ├── deleted_files/
│   │   ├── recovered_document.docx
│   │   ├── recovered_photo.jpg
│   │   └── ...

Success rates: Recently deleted files (within days) have near 100% recovery. Files deleted months ago may be partially overwritten. Fragmented files might not recover perfectly.

File carving for corrupted drives

When the file system is damaged, use file carving:

# In Autopsy, go to Tools -> File Carving
# Or run from command line with Sleuth Kit

# carve JPEGs from an image
fls -r evidence.img
find evidence.img -type f -name "*.jpg"

# More advanced carving with scalpel
# First configure scalpel.conf with file signatures
scalpel -c scalpel.conf -o output_dir evidence.img

File carving looks for file signatures (magic bytes) rather than relying on filesystem metadata. It's slower but can recover files from even heavily damaged drives.

Real-world example: Recovering accidentally deleted business files

Here's how I approached the client situation:

1. Created a disk image of the affected drive using dd
2. Opened Autopsy and created a new case
3. Added the disk image as data source
4. Ran basic ingest modules (skipped keyword search initially)
5. Browsed to "Deleted Files" and filtered by Office documents
6. Found 47 deleted DOCX/XLSX files from the past week
7. Extracted all of them to verify
8. 45 of 47 files opened successfully with no corruption

Total time: about 4 hours (most was waiting for the initial ingest to complete). The alternative would have been days of manual reconstruction or permanent data loss.

Understanding what can and can't be recovered

Important to set expectations:

SSD note: Modern SSDs with TRIM can make deleted files unrecoverable quickly. The TRIM command tells the SSD which blocks are no longer in use, and the SSD wipes them proactively for performance.

Advanced: Timeline analysis

The timeline view shows file activity over time:

# Events shown in timeline:
- File created
- File modified
- File accessed
- File deleted
- Metadata changes

# You can filter by:
- Date range
- Event type
- File type
- Specific users (on multi-user systems)

Useful for understanding what happened to a system. Found malware that created files at 3 AM? Timeline will show it clearly.

Common pitfalls to avoid

• Never work on the original drive - Always create an image first
• Don't recover to the same drive - You might overwrite other deleted files
• SSDs need immediate action - TRIM can wipe deleted files quickly
• Encrypted drives need passwords - BitLocker/FileVault without keys = no recovery
• Cloud sync can interfere - Disable Dropbox/OneDrive before recovery

When to use Autopsy vs simpler tools

Autopsy is overkill for simple situations:

Resources for learning more

• Official Autopsy Documentation - Comprehensive reference
• Sleuth Kit - The underlying command-line tools
• CFLabs - More advanced forensics training and tools
• DFIR.org - Digital Forensics and Incident Response community

Bottom line

Autopsis is professional-grade forensics software that happens to be free and open-source. It's not the simplest tool for basic file recovery, but when you need deep analysis, timeline reconstruction, or are working with damaged drives, it's incredibly powerful.

The learning curve is worth it. Even if you only use it occasionally, having a proper forensics tool in your toolkit can save the day when simpler recovery software fails.