Autopsy is a free and open source analysis tool initially developed by Brian Carrier. Autopsy started as a graphical user interface for the underlying Linux-based SleuthKit toolset, but since version 3, it is a standalone tool built for Windows. Autopsy can be downloaded from http://www.sleuthkit.org/autopsy/.

Autopsy is not intended to perform acquisitions of mobile devices, but can analyze most common Android filesystems (such as YAFFS and EXT). For this example, we will load a full physical image obtained via dd from a Samsung Galaxy J7.