Writing Autopsy Python Modules

Eugene Livis
Basis Technology

Autopsy

When you need to write a forensics tool to solve a problem, you should really consider doing it as an Autopsy module because it will handle all of the tedious work associated with reading data sources, user interface, and reporting. When you make an Autopsy module, you can focus on the analytics and parsing data.

This talk will provide a very quick overview of writing a Python ingest module. These modules will get passed in a copy of every file in the system and you can use them to decode app databases, find encryption, and parse new file formats. After this talk, you’ll be ready to copy one of our Python module templates and make a module.

About Eugene Livis

Eugene Livis is a Software Engineer at Basis Technology making contributions to Autopsy framework development, its internal modules, as well as customer interactions.