The Sleuth Kit
C library and command-line tools for disk and file system forensics that parse NTFS, FAT, EXT, HFS+, and APFS images to recover deleted files.
Technical Architecture & Overview
The Sleuth Kit (TSK) is a C library and collection of command-line tools for analyzing disk images and recovering files. It underpins Autopsy and many other forensic products. Brian Carrier and Sleuth Kit Labs maintain the project. Source files carry different licenses, including the Common Public License, IBM Public License, and GPL-2.0.
Targeted Technical Use Cases
Parse file systems, recover deleted files, and generate timelines from raw disk or image files in scripts or automated workflows.
Evaluation & Trade-offs
Core Strengths
- +Stable library used by many commercial and open-source forensic tools.
- +Supports many file systems, including NTFS, FAT, EXT, HFS+, and APFS.
Trade-Offs & Limitations
- -License terms vary by source file, which may complicate redistribution.
- -Command-line usage requires scripting knowledge for complex workflows.
Defensive Security Application
Parse disk images and file system metadata to locate deleted or hidden data, reconstruct events, and scope compromise.
Frequently Asked Questions
What is The Sleuth Kit?→
The Sleuth Kit (TSK) is a C library and collection of command-line tools for analyzing disk images and recovering files. It underpins Autopsy and many other forensic products. Brian Carrier and Sleuth Kit Labs maintain the project. Source files carry different licenses, including the Common Public License, IBM Public License, and GPL-2.0.
What is The Sleuth Kit used for?→
Parse file systems, recover deleted files, and generate timelines from raw disk or image files in scripts or automated workflows.
What are the strengths of The Sleuth Kit?→
- +Stable library used by many commercial and open-source forensic tools.
- +Supports many file systems, including NTFS, FAT, EXT, HFS+, and APFS.
What are the limitations of The Sleuth Kit?→
- +License terms vary by source file, which may complicate redistribution.
- +Command-line usage requires scripting knowledge for complex workflows.
How is The Sleuth Kit used defensively?→
Parse disk images and file system metadata to locate deleted or hidden data, reconstruct events, and scope compromise.