[2] Autopsy hashes the files in the volume it is analyzing, unpacking compressed archives including ZIP and JAR.

Further, Autopsy parses and catalogues some email and contact file formats, flags phone numbers, email addresses, and files, as well as SQLite or PostgreSQL database stores occurrences of names, domains, phone numbers, and Windows registry files indicating past connections to USB devices.

A partial image of files returned by a search can be saved in VHD format.

[3] Autopsy includes a graphical user interface to display its results, wizards and historical tools to repeat configuration steps, and plug-in support.

Both open-source and closed-source Modules exist for the core browser, including functionality related to scanning files, browsing results, and summarizing findings.