# Autopsy Autopsy is a technology or product recorded in [[Scanned_20260730-1706|Scanned_20260730-1706]]. In the reconstruction, The Sleuth Kit provides filesystem-analysis libraries and tools; Autopsy is its graphical forensic platform (Autopsy/Sleuth Kit). ## Historical and Technical Context This is a broad [[Digital Forensics|digital-forensics]] and filesystem-recovery package plan. [[The Sleuth Kit|The Sleuth Kit]] provides filesystem-analysis libraries and tools; [[Autopsy|Autopsy]] is its graphical forensic platform ([Autopsy/Sleuth Kit](https://www.sleuthkit.org/autopsy/)). [[Guymager|Guymager]], noted on later pages, is a forensic imager capable of raw, EWF, and AFF acquisition ([Guymager](https://guymager.sourceforge.io/)). [[TestDisk|TestDisk]] repairs partition structures and recovers files; [[Scalpel|Scalpel]] carves files by signatures; [[Safecopy|safecopy]] reads data from failing media; `scrounge-ntfs` reconstructs NTFS files; `disktype` identifies disk formats. `partimage`, `partclone`, and `rear` (Relax-and-Recover) serve backup/recovery. The bottom line explicitly targets NTFS, APFS, HFS, and Btrfs, demonstrating cross-platform intent. ## Role in Scanned_20260730-1706 The page is effectively a build manifest for a forensic/recovery Linux distribution capable of ingesting Apple, Windows, Linux, removable-media, and damaged-storage formats. ## Notebook Evidence - [[Scanned_20260730-1706|Scanned_20260730-1706]], PDF page 16: APT package inventory for filesystems and forensics. **Evidentiary status:** The page occurrence and transcription are notebook evidence. Technical identification follows the source reconstruction’s cited research. Co-occurrence does not by itself prove ownership, deployment, or a direct operational relationship. ## Relationships and Overlays On the cited page or pages, Autopsy appears with [[Digital Forensics|Digital Forensics]], [[Guymager|Guymager]], [[Safecopy|Safecopy]], [[Scalpel|Scalpel]], [[TestDisk|TestDisk]], [[The Sleuth Kit|The Sleuth Kit]]. These are page-level or reconstruction-level relationships, not automatic claims of dependency. ## Cross-Notebook Significance This note extends the recovery and boot-media concerns in [[Scanned_20260730-1802|Scanned_20260730-1802]], especially its Linux services, NFS, installer inventory, and bootable USB/UEFI pages. The new notebook turns those components into a reversible acquisition and recovery workflow. ## Missed Signals and Open Leads Some package names may never have existed under the exact spellings recorded; compare against an APT history or installation script before canonicalizing them. ## Sources - [[Scanned_20260730-1706|Scanned_20260730-1706]], especially PDF page(s) 16. - `Scanned_20260730-1706.pdf`, cited as a plain archival filename; the PDF is not linked from `wiki-notes`. - External research citations used for identification remain preserved in the source reconstruction. - [Autopsy/Sleuth Kit](https://www.sleuthkit.org/autopsy/) - [Guymager](https://guymager.sourceforge.io/)