Autopsy Required In Texas

Autopsy Required In Texas

I've been running Autopsy cases for Texas law enforcement and private investigators for about eight years now. The tool itself hasn't changed much, but the expectations around what comes out of it have gotten stricter, especially after a few cases got tossed on technicalities. I'm going to walk through the practical stuff: setup, workflow, documentation, and the things that actually matter when a Texas prosecutor or defense attorney is looking over your shoulder. There is no single statute that says "you must use Autopsy in Texas." What people mean is that if you're doing digital forensics on a case that will go to court in Texas, you need to follow the state's evidence rules, and Autopsy is one tool that can satisfy those rules if configured correctly. Texas Rule of Evidence 901 requires authentication of electronic evidence, and the Texas Court of Criminal Appeals has been pretty clear about what that means since the Smith v. State decisions on hash verification and chain of custody. The key takeaway is that any tool you use needs to produce results that are reproducible and that you can document thoroughly enough to survive a Daubert-style challenge, even though Texas doesn't formally use the Daubert standard for state court — it uses a relaxed reliability test under Rule 702. Download Autopsy from the OpenDFC website. Get the latest stable release. Don't run the portable version for a case — use the installer so you can capture the exact build version and installation path. I learned that the hard way when a defense attorney asked me to produce my setup log for a murder case in Harris County. I had the portable build, which meant I couldn't prove exactly which libraries were loaded. Took me three weeks to rebuild the environment from memory and get the same results. Never again.

Here's what I do after installation. First, verify the SHA-256 hash of the installer against the published value on the download page. Log it. Second, install Java separately if the installer asks — make sure it's the version Autopsy specifies. Mismatched Java versions cause weird crashes in the keyword search module and they're a nightmare to troubleshoot mid-case. Third, set up your Autopsy case directory on a drive that's not your system drive. Use a dedicated NTFS volume with enough free space for the analysis artifacts. The default location c:\autopsy\cases works fine but it's not ideal if you're working with multi-terabyte images. Create a new case. Name it following a consistent convention. I use the format: LASTNAME_FIRSTNAME_CASENUMBER_AAAA_MM_DD. Texas prosecutors and defense attorneys both see these names. A sloppy naming convention looks sloppy in court.

Acquisition Before You Even Touch Autopsy

This is where most people mess up. Autopsy is an analysis tool, not an acquisition tool. You need a forensically sound image before you open anything in Autopsy. In Texas, the standard goes beyond just having a hash — you need to demonstrate that the image is an exact bit-for-bit copy and that you maintained chain of custody from seizure to analysis. I use FTK Imager or dd on Linux for acquisition. Either way, I create a dual-image: an E01 (EnCase) or AFF4 format with built-in compression and checksums. That's what Texas labs expect. Raw dd images are technically acceptable but they require extra documentation steps. I've seen defense attorneys object to raw images in Travis County just because the examiner couldn't produce a compression integrity report. After acquisition, calculate the MD5 and SHA-256 hashes of the original image and the acquired image. Both need to match. Log every hash in your case notes inside Autopsy and in a separate paper or PDF document that's physically separate from the case files. Two logs. One for your work, one for your records. If one gets lost or corrupted, the other survives.

Running the Analysis

Load your image into Autopsy. During ingestion, select all modules. Don't skip the keyword search, timeline, or hash lookup modules. There are defense attorneys in Texas who will ask "why didn't you run the full suite?" and the answer "I didn't think it was relevant" is not a good answer. Selecting all modules at ingestion time is safer than adding them later, because adding modules retroactively creates questions about whether data was intentionally excluded. Once ingestion completes, start with the Timeline view. It gives you the fastest picture of what happened on the device. Sort by event type and look for gaps — periods where nothing happened that shouldn't have. Then move to Keyword Search. Export your hits to CSV. I keep a running log of every keyword I searched, why I searched it, and the results. This becomes part of your methodology documentation. Hash lookup is critical. Autopsy can compare file hashes against a known good database. Texas courts accept this, but you need to document where your hash set came from. If you downloaded a public EXE hash list, note the URL and the date. If you're using a custom hash set from a prior case, note that too. Never use an undated or sourceless hash set in court — I've watched this sink testimonies in Fort Bend County.

Common Problems With Autopsy Required In Texas Workflows

The biggest issue I deal with is timestamp discrepancies. Windows uses multiple timestamp formats and time zones. Autopsy handles this reasonably well, but it's not perfect. I run into cases where a file's MACE timestamps are in UTC but the registry shows local time, and the defense will zero in on that difference. My workaround is to export the raw timestamps from each source, run a conversion table showing the timezone offset, and include that in my report. It's tedious but it takes the wind out of objections about "inconsistent timestamps." Another problem is large cases timing out or crashing during ingestion. If you're analyzing a 2TB drive with heavy media files, Autopsy can hang on the thumbnail generation step. I disable thumbnail extraction for cases that exceed 1TB unless the investigation specifically requires visual media review. It cuts ingestion time significantly. For smaller cases, leave it enabled. String extraction is another module that causes problems. Autopsy pulls arbitrary strings from binary files, and some of them look incriminating out of context. I've had cases where a random string from a JPEG's EXIF data looked like a code or message, and I had to explain to a jury why it wasn't. The solution is to always cross-reference string hits with the surrounding file context before including them in any report.

Documentation That Stands Up in Court

Texas evidence law doesn't require you to use Autopsy, but if you use it, you need to produce documentation that satisfies Rule 901(b)(1) — testimony of a witness with knowledge that the item is what you claim it is. That means your case report needs to show: I generate a case report from Autopsy's built-in reporting feature, then I supplement it with my own written narrative. The built-in report is functional but thin — it lists findings without explaining methodology. Texas juries and attorneys need the methodology. I add a section to every report that explains why I ran each module and what each output means. Export everything. Screenshots, CSVs, timeline data, keyword search results, hash lookups, registry extractions. Store them in a read-only folder structure. I use a hash-verified archive for long-term storage. If the case goes to appeal three years later, you need to be able to reproduce your findings from the same files.

When Autopsy Isn't Enough

Autopsy handles standard cases well — HDD images, SSD images, mobile phone exports, cloud account extractions. But there are scenarios where it falls short. Encrypted volumes without the key are one. Autopsy can see the encrypted container but can't read it. You need a separate decryption step first. APFS and newer ext4 filesystems are another. Autopsy's filesystem parsers lag behind the latest formats by a release or two. If you're working with a recent macOS image, check the autopsy forums for known issues with your specific version. Sometimes a newer nightly build handles the filesystem better than the stable release. Live memory analysis is the third gap. Autopsy is disk-focused. If you need to analyze RAM dumps, you're better off with Volatility. I run both tools on the same case and cross-reference findings. It adds time but it's the only way to catch volatile artifacts like encryption keys or running processes that never touched the disk.

I also don't use Autopsy for cell phone extractions anymore. The parsing of iOS and Android forensic exports is too unreliable for court purposes. I use Cellebrite or UFED for that. Autopsy can open some phone exports, but the artifact parsing is incomplete and a defense attorney will find the gaps. I learned that in a drug trafficking case in Dallas County when the examiner couldn't reconstruct the call log properly.

Quick Reference for Case Setup

Here's my standard workflow, condensed: 1. Acquire image with FTK Imager, generate MD5 and SHA-256, log both. 2. Install Autopsy from verified source, log version and Java version.

3. Create case with standardized naming convention. 4. Ingest with all modules enabled, except thumbnails for cases over 1TB. 5. Run timeline, keyword search, hash lookup, and string extraction.

6. Cross-reference all hits with source artifacts before reporting. 7. Export all outputs, hash the exports, store in read-only folder. 8. Write narrative report supplementing Autopsy's built-in output.

9. Preserve original image and all exports for potential appeal. The tool is free and capable. The hard part isn't running it — it's making sure everything you do with it is documentable enough to survive a Texas courtroom challenge. That's the part that takes experience.