Possibilities of autopsy tool use for forensic purposes

Abstract

The rapid development and widespread use of information technology has brought dramatic changes in all spheres of human activity. At the present time it is difficult to imagine how the world functioned without these technologies. However, despite all the advantages that it brings, information technology has opened various opportunities for misuse. This has caused the development of a new scientific discipline called digital forensics, which deals with the collection, preservation, analysis and presentation of digital evidence. Since digital evidence is very sensitive (easy to delete, modify, etc.), it cannot usually be detected and seen with the classic tools. Therefore, for this purpose, the use of specialized forensic tools is required, that can successfully identify such evidence. There are a number of forensic tools, commercial and non-commercial, which can be found on the market. Some of them are used for each step in the process of digital forensic investigations, and some are multi-functional. When talking about the differences between commercial and non-commercial tools, a frequently asked question is which tools are better, more reliable, faster, more functional, etc. This paper will describe the use of Autopsy, one of the most famous non-commercial forensic tools, and compare its properties with the commercial tool FTK (Forensic Toolkit).