# Latest **URL:** https://sleuthkit.discourse.group/latest.md [Latest](https://sleuthkit.discourse.group/latest.md) · [Categories](https://sleuthkit.discourse.group/categories.md) --- ## [Welcome to the Sleuth Kit Labs Forum](https://sleuthkit.discourse.group/t/welcome-to-the-sleuth-kit-labs-forum/7)
**Author:** [@system](https://sleuthkit.discourse.group/u/system)\ **Replies:** 0\ **Last updated:** [April 15, 2019, 9:06am UTC](https://sleuthkit.discourse.group/t/welcome-to-the-sleuth-kit-labs-forum/7 "2019-04-15T09:06:26Z")
This site is for discussing our open source tools (Autopsy and The Sleuth Kit), commercial tools (Cyber Triage), and anything else we’re involved in. Users can ask questions here about using the tools. Developers can a… --- ## [Autopsy 4.23.0 start always in Developer mode](https://sleuthkit.discourse.group/t/autopsy-4-23-0-start-always-in-developer-mode/5570)
**Author:** [@Homeuser76](https://sleuthkit.discourse.group/u/Homeuser76)\ **Replies:** 2\ **Last updated:** [September 21, 2026, 10:48am UTC](https://sleuthkit.discourse.group/t/autopsy-4-23-0-start-always-in-developer-mode/5570 "2026-09-21T10:48:23Z")
Since upgrading (clean install) to Autopsy 4.23.0, the application always starts in Developer Mode. This was not the case with version 4.22.1 I have install autopsy-4.23.0-64bit..msi from https://github.com/sleuthkit/a… --- ## [Report Generating](https://sleuthkit.discourse.group/t/report-generating/68)
**Author:** [@Chaminda\_Lakmal](https://sleuthkit.discourse.group/u/Chaminda_Lakmal)\ **Replies:** 10\ **Last updated:** [June 6, 2026, 6:43pm UTC](https://sleuthkit.discourse.group/t/report-generating/68 "2026-06-06T18:43:48Z")
can you add the report in pdf format --- ## [Autopsy on new Macs, ARM architecture](https://sleuthkit.discourse.group/t/autopsy-on-new-macs-arm-architecture/4428)
**Author:** [@garr3ttmj](https://sleuthkit.discourse.group/u/garr3ttmj)\ **Replies:** 11\ **Last updated:** [June 4, 2026, 12:38pm UTC](https://sleuthkit.discourse.group/t/autopsy-on-new-macs-arm-architecture/4428 "2026-06-04T12:38:18Z")
Has anyone been able to get Autopsy to work on the new Mac M2 chip ARM architecture? I tried following the steps here https://slo-sleuth.github.io/tools/InstallingAutopsyOnMacOS.html with some differences like accounting… --- ## [Autopsy Deb package](https://sleuthkit.discourse.group/t/autopsy-deb-package/5527)
**Author:** [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Replies:** 4\ **Last updated:** [May 28, 2026, 9:47pm UTC](https://sleuthkit.discourse.group/t/autopsy-deb-package/5527 "2026-05-28T21:47:07Z")
I have a beta version of an Autopsy deb package if anyone is interested in testing it out. There is no need to install sleuthkit or any of the prereqs the dev package should do it all for you. Let me know if you would li… --- ## [Link Files and Jump Lists](https://sleuthkit.discourse.group/t/link-files-and-jump-lists/5566)
**Author:** [@Sakar](https://sleuthkit.discourse.group/u/Sakar)\ **Replies:** 0\ **Last updated:** [May 3, 2026, 3:26am UTC](https://sleuthkit.discourse.group/t/link-files-and-jump-lists/5566 "2026-05-03T03:26:19Z")
Context/Goal I am currently finalizing a paper on Windows Shell artifact generation and wanted to share some experimental findings regarding the interaction between applications and \`shell32.dll\`. My goal is to understa… --- ## [Autopsy MCP server is faster in LM Studio](https://sleuthkit.discourse.group/t/autopsy-mcp-server-is-faster-in-lm-studio/5558)
**Author:** [@Nanni\_Bassetti](https://sleuthkit.discourse.group/u/Nanni_Bassetti)\ **Replies:** 4\ **Last updated:** [April 27, 2026, 9:15pm UTC](https://sleuthkit.discourse.group/t/autopsy-mcp-server-is-faster-in-lm-studio/5558 "2026-04-27T21:15:05Z")
Hi all, I have been using ollama (local llm) + claude code + autopsy mcp server for a long time and it is really slow and often unresponsive, while I tried integrating it into LMStudio (Developer → Local Server → edit m… --- ## [Cannot launch autopsy](https://sleuthkit.discourse.group/t/cannot-launch-autopsy/5559)
**Author:** [@Luca\_elle](https://sleuthkit.discourse.group/u/Luca_elle)\ **Replies:** 1\ **Last updated:** [April 26, 2026, 3:04am UTC](https://sleuthkit.discourse.group/t/cannot-launch-autopsy/5559 "2026-04-26T03:04:14Z")
Hello everyone, I downloaded and installed autopsy-4.22.1-64bit in Windows 11. I tried to launch it but when I am trying it appears just a blank screen, and Autopsy won’t launch. Tried different ways to launch and I tri… --- ## [Registry Application remains blank](https://sleuthkit.discourse.group/t/registry-application-remains-blank/5560)
**Author:** [@UNLVTom](https://sleuthkit.discourse.group/u/UNLVTom)\ **Replies:** 1\ **Last updated:** [April 26, 2026, 2:49am UTC](https://sleuthkit.discourse.group/t/registry-application-remains-blank/5560 "2026-04-26T02:49:22Z")
Using Autopsy 4.22.1 on Win 11. After running “recent activity”, Used the file viewer to navigate to C:\\Windows\\System32\\config\\SYSTEM and SOFTWARE hives. The Application tab on the detail section remained blank in all c… --- ## [Multiple BitLocker partitions in one image](https://sleuthkit.discourse.group/t/multiple-bitlocker-partitions-in-one-image/5555)
**Author:** [@Dominik](https://sleuthkit.discourse.group/u/Dominik)\ **Replies:** 0\ **Last updated:** [April 19, 2026, 8:20am UTC](https://sleuthkit.discourse.group/t/multiple-bitlocker-partitions-in-one-image/5555 "2026-04-19T08:20:07Z")
I have an image created from a laptop with two BitLocker encrypted partitions; recovery key for both partitions is present. When adding this .E01 to Autopsy, it asks for the expected identifiers, and positively checks i… --- ## [Dark Mode for less eye strain?](https://sleuthkit.discourse.group/t/dark-mode-for-less-eye-strain/2923)
**Author:** [@NZKshatriya](https://sleuthkit.discourse.group/u/NZKshatriya)\ **Replies:** 7\ **Last updated:** [March 21, 2026, 4:27pm UTC](https://sleuthkit.discourse.group/t/dark-mode-for-less-eye-strain/2923 "2026-03-21T16:27:46Z")
Would it be possible get to get a dark mode option, or at least have the program follow what theme has been selected for Windows? --- ## [Recent Documents module stuck at 18% for days](https://sleuthkit.discourse.group/t/recent-documents-module-stuck-at-18-for-days/5546)
**Author:** [@Vincent](https://sleuthkit.discourse.group/u/Vincent)\ **Replies:** 2\ **Last updated:** [February 22, 2026, 11:40am UTC](https://sleuthkit.discourse.group/t/recent-documents-module-stuck-at-18-for-days/5546 "2026-02-22T11:40:30Z")
Hello fellow autopsy community ! I’m currently facing an issue with autopsy 4.22.1 / Sleuth Kit 4.14.0 with the Recent Documents ingest module. On two different cases I’m working on; Recent Documents ingest stalls at 18… --- ## [Drone Module inquiry ](https://sleuthkit.discourse.group/t/drone-module-inquiry/5547)
**Author:** [@JKForensics](https://sleuthkit.discourse.group/u/JKForensics)\ **Replies:** 1\ **Last updated:** [February 18, 2026, 3:11am UTC](https://sleuthkit.discourse.group/t/drone-module-inquiry/5547 "2026-02-18T03:11:49Z")
Is there no longer a Drone Module? I can’t seem to find it in the repos but certain articles mention it. thank you in advance! Jay --- ## [Mac OS Sequoia 15.4 Installation Walkthrough](https://sleuthkit.discourse.group/t/mac-os-sequoia-15-4-installation-walkthrough/5541)
**Author:** [@DarkJodo](https://sleuthkit.discourse.group/u/DarkJodo)\ **Replies:** 3\ **Last updated:** [February 12, 2026, 2:50pm UTC](https://sleuthkit.discourse.group/t/mac-os-sequoia-15-4-installation-walkthrough/5541 "2026-02-12T14:50:47Z")
Hello. I need assistance in installing Autopsy 4.22.1, or any version of Autopsy for that matter. Currently, I am unable to download the 4.22.1.zip file from the homepage, and get the “not found” notification. Also, if … --- ## [Stopped at Analyzing Registry ](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210)
**Author:** [@Steve](https://sleuthkit.discourse.group/u/Steve)\ **Replies:** 14\ **Last updated:** [January 22, 2026, 2:10pm UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210 "2026-01-22T14:10:35Z")
Good Day, I am a student working on creating a project image for other students to analyze. I am using an HP Pavilion laptop running WIN10 as the target machine. It has a 250gb hard drive with about 220 of that usable… --- ## [Linux/macOS Autopsy ZIP file not found](https://sleuthkit.discourse.group/t/linux-macos-autopsy-zip-file-not-found/5526)
**Author:** [@randye007](https://sleuthkit.discourse.group/u/randye007)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 11:14pm UTC](https://sleuthkit.discourse.group/t/linux-macos-autopsy-zip-file-not-found/5526 "2025-12-03T23:14:49Z")
Hi, When I access the Linux/macOS ZIP file from the Downloads page, I get a file not found error. Please advise. --- ## [Timeline Analysis - (re)enable](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154)
**Author:** [@ML62](https://sleuthkit.discourse.group/u/ML62)\ **Replies:** 14\ **Last updated:** [October 6, 2025, 1:12pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154 "2025-10-06T13:12:49Z")
Hi When I request a timeline, Autopsy displays “Too many files in DB … timeline will be disabled” message. Is it possible to force this analysis or even to give selective criteria to carry out this analysis ? Thanks … --- ## [Program's UI got messy and stop working after running for a while ](https://sleuthkit.discourse.group/t/programs-ui-got-messy-and-stop-working-after-running-for-a-while/5506)
**Author:** [@HateFromAbove](https://sleuthkit.discourse.group/u/HateFromAbove)\ **Replies:** 0\ **Last updated:** [August 4, 2025, 3:53pm UTC](https://sleuthkit.discourse.group/t/programs-ui-got-messy-and-stop-working-after-running-for-a-while/5506 "2025-08-04T15:53:11Z")
The program was running into weird error during the process of the ingestion module. It seems to stop working when reaching the amount of time or progress. The interface got broken and distorted, and part of the screen d… --- ## [unable to create SQLite database](https://sleuthkit.discourse.group/t/unable-to-create-sqlite-database/5505)
**Author:** [@vahit](https://sleuthkit.discourse.group/u/vahit)\ **Replies:** 0\ **Last updated:** [August 4, 2025, 3:53pm UTC](https://sleuthkit.discourse.group/t/unable-to-create-sqlite-database/5505 "2025-08-04T15:53:03Z")
Hi All, After installation on win11 , I tried to ingest but failed. I detected that central repository is not created. while I try to create SQLite central repository db ı face below error. I control also path and perm… --- ## [Migrating Index from local to a solr server instance](https://sleuthkit.discourse.group/t/migrating-index-from-local-to-a-solr-server-instance/5504)
**Author:** [@Swappage](https://sleuthkit.discourse.group/u/Swappage)\ **Replies:** 0\ **Last updated:** [August 4, 2025, 3:52pm UTC](https://sleuthkit.discourse.group/t/migrating-index-from-local-to-a-solr-server-instance/5504 "2025-08-04T15:52:57Z")
Hello, I have a pretty big case that I started working on locally on a single user instance, using Autopsy directly for the ingestion. Now I need to perform some queries on the indexed data that SOLR can perform but un… --- ## [Incorporation of MediaInfo into ingesting](https://sleuthkit.discourse.group/t/incorporation-of-mediainfo-into-ingesting/5503)
**Author:** [@mtoomey](https://sleuthkit.discourse.group/u/mtoomey)\ **Replies:** 0\ **Last updated:** [August 4, 2025, 3:31pm UTC](https://sleuthkit.discourse.group/t/incorporation-of-mediainfo-into-ingesting/5503 "2025-08-04T15:31:46Z")
This is my first post so bear with me. In some casework I perform, I come across images and videos that have a the normal created/modified dates with EXIF data identifying the device utilized. I utilize MediaInfo to iden… --- ## [ITunes Backup Process](https://sleuthkit.discourse.group/t/itunes-backup-process/2727)
**Author:** [@Cyberpi777](https://sleuthkit.discourse.group/u/Cyberpi777)\ **Replies:** 9\ **Last updated:** [July 16, 2025, 3:54pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727 "2025-07-16T15:54:58Z")
I am using Autopsy 4.18 I am trying to process a iTunes backup of a iPhone 6 IOS 13. I can’t get the program to process the backup I converted the backup to a .tar will allow me to add the file but will not process. --- ## [This error occurs when loading the Autopsy 4.22.1 ingest modules.](https://sleuthkit.discourse.group/t/this-error-occurs-when-loading-the-autopsy-4-22-1-ingest-modules/5483)
**Author:** [@Fernando\_Bar](https://sleuthkit.discourse.group/u/Fernando_Bar)\ **Replies:** 1\ **Last updated:** [June 23, 2025, 2:04pm UTC](https://sleuthkit.discourse.group/t/this-error-occurs-when-loading-the-autopsy-4-22-1-ingest-modules/5483 "2025-06-23T14:04:40Z")
This error occurs when loading the Autopsy 4.22.1 ingest modules: What should I do? Thank you. --- ## [\[Bug?\] Missing files in Autopsy 4.21/4.22 from macOS 10.4 disk image (HFS+)](https://sleuthkit.discourse.group/t/bug-missing-files-in-autopsy-4-21-4-22-from-macos-10-4-disk-image-hfs/5474)
**Author:** [@Titouan\_Le\_bret](https://sleuthkit.discourse.group/u/Titouan_Le_bret)\ **Replies:** 4\ **Last updated:** [June 11, 2025, 9:10am UTC](https://sleuthkit.discourse.group/t/bug-missing-files-in-autopsy-4-21-4-22-from-macos-10-4-disk-image-hfs/5474 "2025-06-11T09:10:04Z")
Hi everyone, I’m running into an issue with Autopsy 4.21 on Ubuntu 22.04. I’m analyzing a .img disk image created from a macOS 10.4 (Tiger) system running in QEMU. When I mount the image manually (using sudo mount -t h… --- ## [Autopsy 4.22.1 SIGSEGV attempting to ingest bitlocker image](https://sleuthkit.discourse.group/t/autopsy-4-22-1-sigsegv-attempting-to-ingest-bitlocker-image/5475)
**Author:** [@tbernhar](https://sleuthkit.discourse.group/u/tbernhar)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 1:43pm UTC](https://sleuthkit.discourse.group/t/autopsy-4-22-1-sigsegv-attempting-to-ingest-bitlocker-image/5475 "2025-06-06T13:43:30Z")
Running Autopsy 4.22.1 installed with SNAP on Ubuntu 20.04 (SANS Sift Workstation). Ingesting an EWF Full Disk Image (256GB NVME) created with efwacquire. Image is from a Windows 11 Enterprise system with BitLocker ena… --- ## [Webroot AV: Autopsy 4.22.1 MANIFESTTOOL.EXE identifed as Pua.Gen (False positive?)](https://sleuthkit.discourse.group/t/webroot-av-autopsy-4-22-1-manifesttool-exe-identifed-as-pua-gen-false-positive/5441)
**Author:** [@TechNash](https://sleuthkit.discourse.group/u/TechNash)\ **Replies:** 4\ **Last updated:** [May 26, 2025, 5:10pm UTC](https://sleuthkit.discourse.group/t/webroot-av-autopsy-4-22-1-manifesttool-exe-identifed-as-pua-gen-false-positive/5441 "2025-05-26T17:10:11Z")
Hello all, I recently upgraded to 4.22.1 and later found an alert from Webroot stating the manifest tool had been identified as Pua.Gen. I’m certain this is a false positive, but just wanted to bring this to the attenti… --- ## [Autopsy Case Stuck Loading Forever](https://sleuthkit.discourse.group/t/autopsy-case-stuck-loading-forever/5442)
**Author:** [@Hydras](https://sleuthkit.discourse.group/u/Hydras)\ **Replies:** 2\ **Last updated:** [May 26, 2025, 5:09pm UTC](https://sleuthkit.discourse.group/t/autopsy-case-stuck-loading-forever/5442 "2025-05-26T17:09:32Z")
After Creating my Case and giving it a name, the screen just remain blank white, cannot click anything, my cursor is permanently a loading icon. additionally, when i tried to click “browse” whilst selecting my file desti… --- ## [Problem with Hex](https://sleuthkit.discourse.group/t/problem-with-hex/5462)
**Author:** [@Guizanhas](https://sleuthkit.discourse.group/u/Guizanhas)\ **Replies:** 1\ **Last updated:** [May 22, 2025, 2:49pm UTC](https://sleuthkit.discourse.group/t/problem-with-hex/5462 "2025-05-22T14:49:19Z")
My Hex on the analisys desapeared. How I make it appear again? --- ## [Install Language Pack](https://sleuthkit.discourse.group/t/install-language-pack/5464)
**Author:** [@HunterD](https://sleuthkit.discourse.group/u/HunterD)\ **Replies:** 1\ **Last updated:** [May 22, 2025, 2:47pm UTC](https://sleuthkit.discourse.group/t/install-language-pack/5464 "2025-05-22T14:47:01Z")
Hello, I am running into a problem. Online says that Autopsy can handle different languages but I can’t seem to locate the language pack I need or any language packs. Where can I locate the langue packs? I am trying t… --- ## [Keyword list hits COUNT result](https://sleuthkit.discourse.group/t/keyword-list-hits-count-result/5465)
**Author:** [@Black\_Thanos](https://sleuthkit.discourse.group/u/Black_Thanos)\ **Replies:** 1\ **Last updated:** [May 22, 2025, 2:39pm UTC](https://sleuthkit.discourse.group/t/keyword-list-hits-count-result/5465 "2025-05-22T14:39:38Z")
I have extracted some URL data relating to a keyword search list into a CSV file, it has a column named COUNT, what is the relevance of this number? Is it the number of times the URL was visited? Or simply how many tim… [Next page](https://sleuthkit.discourse.group/latest.md?page=1)