Autopsy is a graphical forensics platform built on top of The Sleuth Kit. Where Volatility targets a memory dump, Autopsy targets a disk or filesystem image — it's the tool to reach for when a challenge hands you a .img, .E01, or raw disk file instead of a memory capture, and you need to find something a normal file browser would never show you: a deleted file, a hidden partition, or a timestamp that doesn't add up.
Loading a disk image
Start a new case and point it at the image file:
File → New Case → (name it, pick a directory)
Add Data Source → Disk Image or VM File → select challenge.imgAutopsy runs its ingest modules (file type identification, hash lookup, keyword indexing) automatically on load — for a small CTF image this usually finishes in well under a minute, and everything below works off that same indexed data.
Browsing the filesystem and recovering deleted files
The Data Sources tree on the left mirrors the image's actual directory structure, but it also surfaces entries a normal OS wouldn't show:
Data Sources → challenge.img → vol1 → [root] → (look for red "deleted" markers)A deleted file whose data hasn't been overwritten yet still shows up here, flagged, and can be exported with a right-click → Extract File(s) — often exactly where a "recover the deleted flag" challenge hides its answer.
Searching for the flag directly
Rather than browsing file by file, use the built-in keyword search across the whole image:
Keyword Search (top-right) → "flag{" → set to Substring or RegEx matchBecause Autopsy indexes file contents (including inside some archive and document formats) during ingest, this searches file slack space and unallocated clusters too — catching a flag string that was deleted but not yet overwritten, not just one sitting in a file you'd find by browsing.
Timeline analysis
Tools → Timeline → filter to a date range around the suspicious activityThe Timeline view plots file creation, modification, and access events chronologically — useful when a challenge's story involves "something happened at a specific time" and you need to see what files were touched in that window, rather than searching for content directly.
Why it's worth learning
A lot of what Autopsy does, you could technically do with mmls, fls, and icat from The Sleuth Kit's own command-line tools underneath it. The value of the GUI is speed under time pressure: browsing a recovered file tree, scanning a timeline, and running a keyword search are all a few clicks instead of remembering the right flag combination for each command — which adds up when a disk forensics challenge is one of several you're working through a countdown clock.