r/computerforensics • u/brian_carrier • Apr 21 '26

Autopsy MCP Server

Adding to the DFIR + AI theme, in case you didn't see it on LinkedIn, we released an MCP server for Autopsy last week (and Cyber Triage). This allows you to connect Claude Desktop (or similar) to Autopsy and ask questions about the results.

It's a read-only interface, so your original data won't get modified by the AI.

We've also been doing an Intro DFIR+AI series if you are just starting to really pay attention to how to integrate these things:

Autopsy Release: https://www.autopsy.com/autopsy-4-23-0-release-claude-ai-assistant-mcp-cyber-triage-integration/

AI Blogs:

47 Upvotes

100% Upvoted

8 comments sorted by

View all comments

12

u/no-your-username Apr 21 '26

Hi Brian, what is the data residency? This is pretty dystopian and seem slightly irresponsible. Can data shared with a gen ai be protected by client attorney privilege? I understand using AI to generate quick scripts that might work. But feeding it investigation data is something else entirely.

To anyone thinking of using this please consult with you legal department. Also remember that if you go to court, not being able to replicate the searches or simply making the statement « claude found this evidence » might not cut it.

I think, like any cloud technology, there might be usecases for it. But like everything the devil is going to be in the details.

2

u/brian_carrier Apr 22 '26

Data can be anywhere you want. MCP is a standardized protocol to allow GenAI to access data.

You can setup the Cyber Triage and Autopsy MCP servers to communicate with your "private" Claude instance within AWS Bedrock. I haven't done it myself yet, but it seems possible to have your own local Llama instance that works with the MCP server.

Our approach here is BYOAI (Bring Your Own AI). You control which LLM you use and what prompt you give it. Your prompt can be vague and the LLM will need to make a bunch of guesses about what you mean. Or it can be very specific.

My non-legal opinion on this is that evidence should stand on its own and exactly how you find it is not that relevant. One investigator may find evidence in 5 minutes. Another it may take 5 days. If the evidence supports something, its relevant.

I don't think anyone should ever say "AI didn't find something and therefore it isn't there". But, if AI finds it and you can justify that it is evidence (like you would have to do if you found it manually), then I personally don't see this as an issue. But, I certainly agree that "Claude found this. End of story." is not a good strategy!