|-d evid_locker||Directory where cases and hosts are stored. This overrides the LOCKDIR value in conf.pl. The path must be a full path (i.e. start with /).|
|-i device filesystem mnt||Specify the information for the live analysis mode. This can be specified as many times as needed. The device field is for the raw file system device, the filesystem field is for the file system type, and the mnt field is for the mounting point of the file system.|
|-p port||TCP port for server to listen on.|
|addr||IP address or host name of where investigator is located. If localhost is used, then localhost must be used in the URL. If you use the actual hostname or IP, it will be rejected.|
The following variables can be set in conf.pl.
USE_STIMEOUTWhen set to 1 (default is 0), the server will exit after STIMEOUT seconds of inactivity (default is 3600). This setting is recommended if cookies are not used.BASEDIRDirectory where cases and forensic images are located. The images must have simple names with only letters, numbers, _, -, and .. (See FILES).TSKDIRDirectory where The Sleuth Kit binaries are located.NSRLDBLocation of the NIST National Software Reference Library (NSRL).INSTALLDIRDirectory where Autopsy was installed.GREP_EXELocation of grep(1) binary.STRINGS_EXELocation of strings(1) binary.
Evidence LockerThe Evidence Locker is where all cases and hosts will be saved to. It is a directory that will have a directory for each case. Each case directory will have a directory for each host.<CASE_DIR>/case.aut
This file is the case configuration file for the case. It contains the description of the case and default subdirectories for the hosts.<CASE_DIR>/investigators.txt
This file contains the list of investigators that will use this case. These are used for logging only, not authentication.<HOST_DIR>/host.aut
This file is where the host configuration details are saved. It is similar to the fsmorgue file from previous versions of Autopsy. It has an entry for each file in the host and contains the host description.md5.txt
Some directories will have this file in it. It contains MD5 values for important files in the directory. This makes it easy to validate the integrity of images.
# ./autopsy -p 8888 10.1.34.19
The Autopsy Forensic Browser requires The Sleuth Kit <www.sleuthkit.org/sleuthkit>
autopsy first appeared in Autopsy v1.0.
This software is distributed under the GNU Public License.
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
|User Manuals||AUTOPSY (1)||MAR 2005|