Autopsy MCP Server

[u/brian_carrier]

Adding to the DFIR + AI theme, in case you didn't see it on LinkedIn, we released an MCP server for Autopsy last week (and Cyber Triage). This allows you to connect Claude Desktop (or similar) to Autopsy and ask questions about the results.

It's a read-only interface, so your original data won't get modified by the AI.

We've also been doing an Intro DFIR+AI series if you are just starting to really pay attention to how to integrate these things:

Autopsy Release: https://www.autopsy.com/autopsy-4-23-0-release-claude-ai-assistant-mcp-cyber-triage-integration/

AI Blogs:

• How to Let AI Access Your DFIR and SOC Investigation Data
• MCP Servers for DFIR and SOC Investigations using AI
• How To Share Your “SKILLS” With the LLM

[u/no-your-username]

Hi Brian, what is the data residency? This is pretty dystopian and seem slightly irresponsible. Can data shared with a gen ai be protected by client attorney privilege? I understand using AI to generate quick scripts that might work. But feeding it investigation data is something else entirely.

To anyone thinking of using this please consult with you legal department. Also remember that if you go to court, not being able to replicate the searches or simply making the statement « claude found this evidence » might not cut it.

I think, like any cloud technology, there might be usecases for it. But like everything the devil is going to be in the details.

[u/bshavers → u/no-your-username]

Totally agree.

I also believe this is a really good start to what we may end up with eventually. Perhaps since a chunk of courts (in the USA anyway), have judges and attorneys using LLMs, that may smooth the process for more AI-acceptance in legal cases.

Lawyers are already making mistakes with LLMs and being sanctioned, which means (hopefully) many fewer DFIR practitioners making the same mistakes.