repository·master·Indexed 20 days ago
https://github.com/sleuthkit/autopsy_addon_modulesA central hub for 3rd party add-on modules for the Autopsy Digital Forensics Platform. This repository organizes modules by type, including Ingest modules (e.g., Amazon Ecosystem Parser, Antivirus scanner, Atomic Wallet), Content Viewer modules (e.g., BinEd Binary Viewer, Event Log Viewer, LNK File Viewer, Multi Content Viewer), Report modules, and Data Source Processors.
The EML Parser is an Autopsy ingest module designed to parse email files with the .eml extension. It allows forensic investigators to extract and analyze email content within the Autopsy framework.
The Parse SQLite Databases module is an Autopsy ingest module designed to parse SQLite databases as defined by the user. This allows for the extraction and analysis of data stored within SQLite database files during a forensic investigation.
The Timesketch ingest module is an Autopsy add-on designed to identify all time-based artifacts within a case and transmit them to a Timesketch server for analysis.
Requirements and Compatibility:
The Parse USN Journal module is an Autopsy add-on designed to parse the Update Sequence Number (USN) Journal found within Windows disk images. This allows investigators to track file system changes and metadata updates recorded in the journal.
The SPAI Model Report Module is a custom report module created for The DGPTC - Technical Police. It is designed to extend Autopsy's reporting capabilities.
Requirements:
Resources:
SPAIModelReportModule_py_GPL_License.txt within the module for details).The Copy-Move module is a package designed for Autopsy that includes both a File Ingest Module and a Data Content Viewer. It enables users to detect Copy-Move forgeries within images contained in a datasource.
The Shimcache parser is an Autopsy ingest module designed to parse the Shimcache (Application Compatibility Cache) on Windows systems. This module helps forensic investigators identify executed files and their metadata from Windows artifacts.
Requirements and Compatibility:
.plist) files found on macOS systems. This module allows forensic investigators to extract and analyze user-defined data contained within these files during an Autopsy analysis.The sdhash module enables fuzzy hash matching within Autopsy. It allows investigators to perform two primary types of matching:
sdhash reference sets as part of the automated ingest process.Requirements: