The Sleuth Kit (TSK) is a library and collection of command line file and volume system forensic analysis tools that allow you to investigate and analyze volume and file system data. With this software, investigators can identify and recover evidence from images acquired during incident response or from live systems. The software is open source, which allows investigators to verify the actions of the tool or customize it to specific needs.
The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
The volume system (media management) tools allow you to examine the layout of disks and other media. TSK supports DOS partitions, BSD partitions (disk labels), Mac partitions, Sun slices (Volume Table of Contents), and GPT disks. With these tools, you can identify where partitions are located and extract them so that they can be analyzed with file system analysis tools.
TSK allows users to analyze a disk or file system image created by ‘dd’, or a similar application that creates a raw image. These tools are low-level and each performs a single task. When used together, they can perform a full analysis.
TSK is based on The Coroner’s Toolkit.
Key Features
- Analyzes raw (i.e. dd), Expert Witness (i.e. EnCase) and AFF file system and disk images.
- Supports the NTFS, FAT, UFS 1, UFS 2, EXT2FS, EXT3FS, and ISO 9660 file systems
- Tools can be run on a live system during Incident Response. These tools will show files that have been “hidden” by rootkits and will not modify the A-Time of files that are viewed.
- List allocated and deleted ASCII and Unicode file names.
- Display the details and contents of all NTFS attributes (including all Alternate Data Streams).
- Display file system and meta-data structure details.
- Create time lines of file activity, which can be imported into a spread sheet to create graphs and reports.
- Lookup file hashes in a hash database, such as the NIST NSRL, Hash Keeper, and custom databases that have been created with the ‘md5sum’ tool.
- Organize files based on their type (for example all executables, jpegs, and documents are separated). Pages of thumbnails can be made of graphic images for quick analysis.
- ‘md5’ and ‘sha1’ tools to generate hashes of files and other data.
- hfind creates an index of a hash database and perform quick lookups using a binary search algorithm.
- ils lists all metadata entries, such as an Inode.
- blkls displays data blocks within a file system (formerly called dls).
- fls lists allocated and unallocated file names within a file system.
- fsstat displays file system statistical information about an image or storage medium.
- ffind searches for file names that point to a specified metadata entry.
- mactime creates a timeline of all files based upon their MAC times.
- disk_stat discovers the existence of a Host Protected Area.
Website: www.sleuthkit.org
Support:
Developer: Brian Carrier
License: IBM Public License, Common Public License, GNU General Public License v2.0
TSK is written in C, C++, and Java. Learn C with our recommended free books and free tutorials. Learn C++ with our recommended free books and free tutorials. Learn Java with our recommended free books and free tutorials.
Related Software
| Digital Forensics Tools | |
|---|---|
| GRR Rapid Response | Remote live forensics for incident response |
| Radare2 | Portable reversing framework |
| The Sleuth Kit | Collection of tools for forensic analysis |
| Autopsy Forensic Browser | Graphical interface to SleuthKit |
| iaito | Official graphical interface for radare2 |
| Volatility | Advanced memory forensics framework |
| guymager | Forensic imaging tool based on Qt |
| dcfldd | Enhanced version of dd for forensics and security |
| rdd | Forensic copy program |
| Jomon | Network forensics and passive sniffer |
| Mozilla InvestiGator | Real-time digital forensics and investigation platform |
| Velociraptor | Endpoint visibility and collection tool |
| Timesketch | Collaborative forensic timeline analysis |
| Plaso | Python-based digital forensics framework |
| MemProcFS | View physical memory as files in a virtual file system |
| Chainsaw | Fast forensic triage and threat hunting tool for Windows artefacts |
Read our verdict in the software roundup.
 Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category.This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form. |