SleuthKit

The Sleuth Kit provides tools for examining filesystems on suspect computers without relying on the host operating system, allowing visibility into deleted and hidden content. Volume system tools analyze disk layouts, recover deleted files, inspect slack spaces, filesystem journals, and partition structures. It supports DOS, BSD, Mac, Sun, and GPT partitions, and filesystems including NTFS, FAT, exFAT, HFS+, Ext3, Ext4, UFS, and YAFFS2.

Use cases include digital forensics investigations where investigators need to extract and analyze data from disk images, identify partitions, recover evidence from unallocated space or slack areas, and generate timelines or file lists for case documentation. The tools are particularly valuable for law enforcement, incident response, and cybersecurity analysis of compromised systems.

The main package contains command line tools, with supporting libraries like libtsk23 for programmatic access and Java bindings for integration into other applications. It operates on raw images or specific formats, focusing on the current filesystem without modifying data.

SleuthKit tools parse disk images and filesystems directly using libraries like libtsk23, bypassing the host OS to access raw structures. Filesystem analysis tools read metadata, inodes, journals, and block allocations to list files, recover deleted content, and extract data units. Volume tools interpret partition tables (DOS, GPT, etc.) to map layouts and extract volumes for further analysis. Common flags specify image formats (-i), filesystem types (-f), sector sizes (-b), offsets (-o), and output modes, with support for decryption (-k), hashing, and recursion.