The Sleuth Kit

The Sleuth Kit
Original author(s)Brian Carrier
Stable release
4.12.1[1] / 29 August 2023; 13 months ago (29 August 2023)
Repository
Written inC, Perl
Operating systemUnix-like, Windows
TypeComputer forensics
LicenseIPL, CPL, GPL
Websitewww.sleuthkit.org/sleuthkit/ Edit this on Wikidata

The Sleuth Kit (TSK) is a library and collection of Unix- and Windows-based utilities for extracting data from disk drives and other storage so as to facilitate the forensic analysis of computer systems. It forms the foundation for Autopsy, a better known tool that is essentially a graphical user interface to the command line utilities bundled with The Sleuth Kit.[2][3]

The collection is open source and protected by the GPL, the CPL and the IPL. The software is under active development and it is supported by a team of developers. The initial development was done by Brian Carrier[4] who based it on The Coroner's Toolkit. It is the official successor platform.[5]

The Sleuth Kit is capable of parsing NTFS, FAT/ExFAT, UFS 1/2, Ext2, Ext3, Ext4, HFS, ISO 9660 and YAFFS2 file systems either separately or within disk images stored in raw (dd), Expert Witness or AFF formats.[6] The Sleuth Kit can be used to examine most Microsoft Windows, most Apple Macintosh OSX, many Linux and some other UNIX computers.

The Sleuth Kit can be used via the included command line tools, or as a library embedded within a separate digital forensic tool such as Autopsy or log2timeline/plaso.

  1. ^ "Release 4.12.1". 29 August 2023. Retrieved 19 September 2023.
  2. ^ Parasram, Shiva V. N. (2017). Digital forensics with Kali Linux: perform data acquisition, digital investigation, and threat analysis using Kali Linux tools. Birmingham, UK. ISBN 978-1-78862-957-7. OCLC 1020288734.{{cite book}}: CS1 maint: location missing publisher (link)
  3. ^ Altheide, Cory (2011). Digital forensics with open source tools: using open source platform tools for performing computer forensics on target systems: Windows, Mac, Linux, UNIX, etc. Harlan A. Carvey. Burlington, MA: Syngress. ISBN 978-1-59749-587-5. OCLC 713324784.
  4. ^ "About". www.sleuthkit.org. Brian Carrier. Retrieved 2016-08-30.
  5. ^ "The Coroner's Toolkit (TCT)".
  6. ^ "File and Volume System Analysis". www.sleuthkit.org. Brian Carrier. Retrieved 2016-08-30.