AUTOPSY(1)

NAME
autopsy - Autopsy Forensic Browser

SYNOPSIS
autopsy [-C] [-m morgue ] [-i investig ] [-l log_dir ] port addr

DESCRIPTION
autopsy starts the Autopsy Forensic Browser server on port and accepts HTTP connections from addr only. The arguments are as follows:

-C  Force the program to not use cookies. This overrides the USE_COOKIE value in conf.pl.

-m morgue
    Directory where images are stored and fsmorgue file is located. This overrides the MORGDIR value in conf.pl. The path must be a full path (i.e. start with /).

-i investig
    Full name of Investigator for Autopsy reports. This overrides the INVESTIG value in conf.pl. (you will need quotation marks for the full name).

-l logdir
    The location to save the log file and cookie file. This is useful when multiple investigators are using the same server.

port
    TCP port for server to listen on.

addr
    IP address or host name of where investigator is located. If localhost is used, then 'localhost' must be used in the URL. If you use the actual hostname or IP, it will be rejected.

When started, the program will display a URL to paste into an HTML browser. The browser must support frames and forms. The Autopsy Forensic Browser will allow an investigator to analyze images generated by dd(1) for evidence. The program allows the images to be analyzed by browsing files, blocks, inodes, or by searching the blocks. The program also generates Autopsy reports that include collection time, investigators name, and MD5 hash values.

VARIABLES
The following variables can be set in conf.pl. USE_COOKIE
    When set to 1 (default value), the server will only accept connections that pass the correct random cookie (which changes for each execution) The cookie value is saved in COOKIE_FILE.
USE_STIMEOUT
    When set to 1 (default is 0), the server will exit after STIMEOUT seconds of inactivity (default is 3600). This setting is recommended if cookies are not used.
USE_LOG
    When set to 1 (default value), errors and unauthorized connections are logged to LOG_FILE.
MORGDIR
    Directory where forensic images are located. The images must have simple names with only letters, numbers, '_', '-', and '.'. (See FILES).
TASKDIR
    Directory where The @stake Sleuth Kit (TASK) binaries are located.
INSTALLDIR
    Directory where Autopsy was installed.
GREP_EXE
    Location of grep(1) binary.
STRINGS_EXE
    Location of strings(1) binary.
INVESTIG
    Full name of forensic Investigator.

FILES
MORGDIR/fsmorgue
    File that lists the images in the Morgue directory and their mounting points. The format of the file is the image name, a tab, the file system type, a tab, the mounting point, a tab, and the original time zone. Comments begin the line with '#'. For example:
          wd0a_root openbsd / EST
          wd0d_var freebsd /var GMT
MORGDIR/md5.txt
    This file contains MD5 hash values for files in the morgue directory. The purpose of this is to validate the integrity of the files. The format is the same as the output of the 'md5' command in TASK (or other UNIX distributions). The MD5 value followed by the file name
          286b206b1e0bffe642fb949d8123d483 fat.dd When appropriate, Autopsy will create entries in this file automatically.

EXAMPLE
# ./autopsy 8888 localhost

SEE ALSO
dd(1), fls(1), ffind(1), ifind(1), grep(1), icat(1) md5(1), strings(1),

REQUIREMENTS
The Autopsy Forensic Browser requires The @stake Sleuth Kit (TASK) <www.atstake.com/research/tools/index.html>

HISTORY
autopsy first appeared in Autopsy v1.0.

LICENSE
This software is distributed under the GNU Public License.

AUTHOR
Brian Carrier <carrier@atstake.com>