autopsy CLI

autopsy --nogui -c <case>

Create an Autopsy case from the command line, the digital forensics suite of The Sleuth Kit with disk image analysis.

Run it when you want the analysis of a disk image with the full suite: autopsy --nogui creates the case from CLI (for automation or for headless servers), and the GUI (or the web server) allows the analysis — the file tree, the timeline, hash lookups (NSRL hashsets), the extensions (malware, email) and the reports. It is the reference open source suite for image analysis: the same Sleuth Kit machinery with the case management layer. In IR, the Autopsy case is the container of the analysis: the image, the findings and the report in one place.

Don't use it for quick triage: case creation and analysis of a large image takes time (file ingestion, hashes) — for a specific question, the direct Sleuth Kit tools (fls, icat) answer faster. Autopsy analysis is manual: the analyst navigates and marks; findings depend on judgment, there is no automatic malware detection. And watch out for the case itself: the Autopsy case database contains the analysis — back it up with the evidence, don't leave it on the work host unprotected. The GUI version is still the natural way to work; the CLI is for automated creation.