A fast digital forensics workbench in pure Rust.
A port of Autopsy: one download, no Java, no Solr.

Features

• Evidence: raw, split and E01 disk images and VMDK, VHD, VHDX and QCOW2 virtual disks; local disks; logical files and folders, including L01 logical evidence files; unallocated space images; XRY text exports; Autopsy logical imager results. NTFS, FAT, exFAT and ext file systems are read, including deleted files
• Analysis: web activity, Windows registry, event logs, jump lists and prefetch, hash sets (MD5, SHA-1, SHA-256), file type detection, keyword search, e-mail (MBOX, EML, vCard), archives, carving, encryption detection, EXIF and GPS
• Review: timeline, file discovery, image gallery (duplicates shown once), communications, geolocation map, tags, result tabs, pop-out viewers
• Reports: HTML, Excel, KML, body file, file lists and tagged-hash sets
• AI agents: a built-in MCP server lets Claude and other assistants search and cite a case
• Plugins: sandboxed WebAssembly ingest modules, written against the same API as the built-in parsers
• Command line: postmortem ingest creates a case and analyses any of these data sources without the GUI

Evidence is only ever read, never modified.

Get it

Download a build for Windows, macOS or Linux from Releases, or build it yourself:

cargo run --release -p postmortem

Ask an AI about your case

postmortem mcp serves a case over the Model Context Protocol, read-only by default. Every result carries a reference (file:123, artifact:45) that opens in the app, and text from the evidence is marked as untrusted, so it can't steer the assistant. For Claude Code:

claude mcp add my-case -- postmortem mcp --case ~/postmortem/Cases/MyCase

Run postmortem mcp --help for the HTTP transport, image previews and write access.

Write a plugin

Plugins are WebAssembly components that run sandboxed in the ingest pipeline. Copy the example plugin, build it for wasm32-wasip2 and drop it in ~/postmortem/Plugins. See docs/PLUGINS.md.

Status

Early and under active development. docs/PARITY.md tracks progress towards feature parity with Autopsy.

License

AGPL-3.0-or-later. The plugin API and SDK (pm-plugin-api, pm-plugin-sdk) are Apache-2.0, so plugins can use any licence. See NOTICE for Autopsy and third-party attributions.

postmortem is not affiliated with or endorsed by the Autopsy project.