• Main Page
• Related Pages

• Autopsy User's Guide

Table of Contents

• Prerequisites
• Deployment Types
• System Memory Requirements
• Download
• Installation

Prerequisites

It is highly recommended to remove or disable any antivirus software from computers that will be processing or reviewing cases. Antivirus software will often conflict with forensic software, and may quarantine or even delete some of your results before you get a chance to look at them.

Deployment Types

Starting with Autopsy 4.0, there are two ways to deploy Autopsy:

• Single-User: Cases can be open by only a single instance of Autopsy at a time. Autopsy installations do not communicate with each other. This is the easiest to install and deploy. This page outlines that installation process.
• Multi-User: Cases can be open by multiple users at the same time and users can see what each other is doing. This collaborative deployment requires installation and configuration of other network-based services. The installation of this deployment is covered in Setting Up Multi-user Environment.

System Memory Requirements

The 64 bit version of Autopsy requires a minimum of 8GB RAM (16 GB recommended). When the 64 bit version of Autopsy is installed on Windows it will be limited to a maximum heap size of 4GB leaving the remaining memory for the operating system, the internal Solr text indexing service and other applications. If you wish to change the maximum heap size you can do so after installation by changing the Maximum JVM Memory value in the Runtime section under Tools -> Options -> Application.

Download

Download Autopsy from the website:

http://sleuthkit.org/autopsy/download.php

The current version of Autopsy 4 is distributed on sleuthkit.org only as a Windows installer. It can run on Linux and OS X, but requires some manual setup.

Installation

To install Autopsy, perform the following steps:

1. Run the Autopsy msi file
2. If Windows prompts with User Account Control, click Yes
3. Click through the dialog boxes until you click a button that says Finish
4. Autopsy should now be fully installed