Center European Research Science informatics

...because open source matters

  • Increase font size
  • Default font size
  • Decrease font size
Home Sleuth Kit Forensic Investigations

Sleuth Kit Forensic Investigation

E-mail Print PDF

Cersi includes Sleuth Kit

Here at Cersi! we have decide to include this because it might be useful to Enterprises & End users ...


The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data. The plug-in framework allows you to incorporate additional modules to analyze file contents and build automated systems. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.


The original part of Sleuth Kit is a C library and collection of command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and hidden content is shown. It runs on Windows and Unix platforms.  Take note that Mac OS X is netBSD(Free Software) which is Unix & Linux is Unix too ... All free software !

The volume system (media management) tools allow you to examine the layout of disks and other media. The Sleuth Kit supports DOS partitions, BSD partitions (disk labels), Mac partitions, Sun slices (Volume Table of Contents), and GPT disks. With these tools, you can identify where partitions are located and extract them so that they can be analyzed with file system analysis tools.

When performing a complete analysis of a system, we all know that command line tools can become tedious. The Autopsy Forensic Browser is a graphical interface to the tools in The Sleuth Kit, which allows you to more easily conduct an investigation. Autopsy provides case management, image integrity, keyword searching, and other automated operations.

A complete analysis also requires more than just file and volume system analysis. Howerever, a single tool can't provide support for all file types and analysis techniques. The TSK Framework allows tool so easily incorporate file analysis modules that were written by other developers. If you are developing a tool, consider incorporating in the framework or developing your analysis technique as a module into the framework.

Input Data

  • Analyzes raw (i.e. dd), Expert Witness (i.e. EnCase) and AFF file system and disk images. (Sleuth Kit Informer #11)
  • Supports the NTFS, FAT, UFS 1, UFS 2, EXT2FS, EXT3FS, HFS, and ISO 9660 file systems (even when the host operating system does not or has a different endian ordering).
  • Tools can be run on a live Windows or UNIX system during Incident Response. These tools will show files that have been "hidden" by rootkits and will not modify the A-Time of files that are viewed. (Sleuth Kit Informer #13)

Search Techniques

  • List allocated and deleted ASCII and Unicode file names. (Sleuth Kit Informer #14 (FAT Recovery), #16 (NTFS Orphan Files))
  • Display the details and contents of all NTFS attributes (including all Alternate Data Streams).
  • Display file system and meta-data structure details.
  • Create time lines of file activity, which can be imported into a spread sheet to create graphs and reports. (Sleuth Kit Informer #5)
  • Lookup file hashes in a hash database, such as the NIST NSRL, Hash Keeper, and custom databases that have been created with the 'md5sum' tool. (Sleuth Kit Informer #6, Sleuth Kit Informer #7)
  • Organize files based on their type (for example all executables, jpegs, and documents are separated). Pages of thumbnails can be made of graphic images for quick analysis. (Sleuth Kit Informer #3, #4, #5)

The Sleuth Kit is written in C and Perl and uses some code and design from The Coroner's Toolkit (TCT). The Sleuth Kit has been tested on:

Open source software allows you to customize the tools for your environment and validate the code. See Open Source Digital Forensics Tools: The Legal Argument.

If you have a feature request, refer to the Support page for details on submitting it.

Last Updated on Friday, 15 March 2013 09:32  


PACKAGE NAME:     hwinfo-20.0-x86_64-1mos

hwinfo: hwinfo (Hardware detection tool)
hwinfo: hwinfo is a simple program that lists results
hwinfo: from the hardware detection library.