[The Sleuth Kit] Library and collection of command line tools to investigate disk images
The Sleuth Kit is a C++ library and collection of open source file
system forensics tools that allow you to, among other things, view
allocated and deleted data from NTFS, FAT, FFS, EXT2, Ext3, HFS+, and
ISO9660 images.
The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data. The plug-in framework
allows you to incorporate additional modules to analyze file contents
and build automated systems. The library can be incorporated into larger
digital forensics tools and the command line tools can be directly used to find evidence.
There are three different packages for each The Sleuth Kit® (TSK) release.
- sleuthkit-X.X.X.tar.gz: This is the source code release of TSK core and framework that you must compile on your computer. This is most commonly used on non-windows systems.
- sleuthkit-X.X.X-win32.zip: This is the compiled windows release of TSK core. This has executables and libraries that allow you to run this on windows.
- sleuthkit-X.X.X-framework-win32.zip: This is the compiled windows release of the framework. It has the tsk_analyzeimg program that allows you to run the framework on a disk image.
[The Sleuth Kit] Library and collection of command line tools to investigate disk images
![[The Sleuth Kit] Library and collection of command line tools to investigate disk images](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNZdH9GrzLMB_dpWM8sD-xIfk4DF4LFrLnPwaCAa8Cwqp298SF2DTJQgkCuLlL6s0gygC0DpUzUsPExjmoLATEWzPK4Qdzj08dNnS6no8oVCglyRYEDQcEbJ-qI6AllePsUpB-6k-K2bA/s72-c/Sleuthkit.gif)
Reviewed by Zion3R
on
9:56 PM
Rating:
Reviewed by Zion3R
on
9:56 PM
Rating:
