Alternatives to Autopsy

Digital forensics platform for disk, file and timeline analysis. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as Autopsy.

  • Velociraptor

    Endpoint monitoring and digital forensics platform driven by a query language.

    FreeOpen sourceWindowsmacOSLinux

    Velociraptor shifts forensics to live endpoints, collecting host state across a fleet with its own query language, instead of analysing disk images in a case-management interface.

  • CAINE

    Ubuntu-based digital forensics live distribution.

    FreeOpen sourceLinux

    CAINE is an Ubuntu-based live distribution bundling acquisition, analysis and reporting tools, with block devices mounted read-only by default, rather than a single installed application.

  • Volatility 3

    Memory forensics framework for extracting artefacts from RAM images.

    FreeProprietaryWindowsmacOSLinuxCommand line

    Volatility 3 is a memory forensics framework extracting artefacts from RAM images, complementing Autopsy's disk and file analysis.

Also worth comparing

These listings name Autopsy as their own alternative, so the relationship runs both ways.

  • The Sleuth Kit

    Command-line tools and a C library for analysing disk images and recovering files in forensic work.

    FreeOpen sourceCommand line

    Autopsy puts a graphical case-management interface on The Sleuth Kit, adding keyword search, timelines and reporting, but ingesting large images takes hours.

Similar software

Related functionality, not a direct replacement.