AUTOPSY(1)

NAME
autopsy - Autopsy Forensic Browser

SYNOPSIS
autopsy [-m morgue ] [-i investig ] port addr

DESCRIPTION
autopsy starts the Autopsy Forensic Browser server on port and accepts HTTP connections from addr only. The arguments are as follows:

-m morgue
    Directory where images are stored and fsmorgue file is located. This overrides the MORGDIR value in conf.pl. The path must be a full path (i.e. start with /).

-i investig
    Full name of Investigator for autopsy reports. This overrides the INVESTIG value in conf.pl. (you will need quotation marks for the full name).

port
    TCP port for server to listen on.

addr
    IP address or host name of where investigator is located. If localhost is used, then 'localhost' must be used in the URL. If you use the actual hostname or IP, it will be rejected.

When started, the program will display a URL to paste into an HTML browser. The browser must support frames and forms. The Autopsy Forensic Browser will allow an investigator to analyze images generated by dd(1) for evidence. The program allows the images to be analyzed by browsing files, blocks, inodes, or by searching the blocks. The program also generates autopsy reports that include collection time, investigators name, and MD5 hash values.

VARIABLES
The following variables can be set in conf.pl. USE_COOKIE
    When set to 1 (default value), the server will only accept connections that pass the correct random cookie (which changes for each execution) The cookie value is saved in COOKIE_FILE.
COOKIE_FILE
    Location where session cookie is stored (default is .autopsy.cook). This file is only readable by the owner.
USE_STIMEOUT
    When set to 1 (default is 0), the server will exit after STIMEOUT seconds of inactivity (default is 3600). This setting is recommended if cookies are not used.
USE_LOG
    When set to 1 (default value), errors and unauthorized connections are logged to LOG_FILE.
LOG_FILE
    Name of log file for errors and unauthorized connections (default is autopsy.log).
MORGDIR
    Directory where forensic images are located. The images must have simple names with only letters, numbers, '_', '-', and '.'. (See FILES).
TCTDIR
    Directory where TCT binaries are located.
TCTUTILDIR
    Directory where TCTUTILs binaries are located.
INSTALLDIR
    Directory where autopsy was installed.
GREP_EXE
    Location of grep(1) binary.
MD5_EXE
    Location of md5(1) or md5sum(1) binary.
STRINGS_EXE
    Location of strings(1) binary.
INVESTIG
    Full name of forensic Investigator.

FILES
MORGDIR/fsmorgue
    File that lists the images in the Morgue directory and their mounting points. The format of the file is the image name a tab and the mounting point. Comments begin the line with '#'. For example:
        wd0a_root    /
        wd0d_var    /var
MORGDIR/zoneinfo
    File that contains a single number that specifies the timezone difference between the analysis site and the compromised site. For example, for analysis being performed in EST (GMT-5) from a host in CST (GMT-6), the file contains -1. Comments begin the line with '#'.

EXAMPLE
# ./autopsy 8888 localhost

SEE ALSO
dd(1), fls(1), find_file(1), find_inode(1), grep(1), icat(1) md5(1), strings(1),

REQUIREMENTS
The Autopsy Forensic Browser requires The Coroners Toolkit <www.fish.com/tct> and TCTUTILs <www.cerias.purdue.edu/homes/carrier/forensics> to run.

HISTORY
autopsy first appeared in autopsy v1.0.

AUTHOR
Brian Carrier <carrier@cerias.purdue.edu>