The Sleuth Kit The Sleuth Kit is a collection of UNIX-based command line file and volume system forensic analysis tools.
Download

The Sleuth Kit Ranking & Summary

The Sleuth Kit Tags

kit security tool computer sleuth kit sleuth computer investigation

The Sleuth Kit Description

The Sleuth Kit is a collection of UNIX-based command line file and volume system forensic analysis tools. The Sleuth Kit (previously known as TASK) is a collection of UNIX-based command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and hidden content is shown.The volume system (media management) tools allow you to examine the layout of disks and other media. The Sleuth Kit supports DOS partitions, BSD partitions (disk labels), Mac partitions, Sun slices (Volume Table of Contents), and GPT disks.With these tools, you can identify where partitions are located and extract them so that they can be analyzed with file system analysis tools.The Sleuth Kit is written in C and Perl and uses some code and design from The Coroner's Toolkit (TCT).Input Data:· Analyzes raw (i.e. dd), Expert Witness (i.e. EnCase) and AFF file system and disk images.· Supports the NTFS, FAT, UFS 1, UFS 2, EXT2FS, EXT3FS, and ISO 9660 file systems (even when the host operating system does not or has a different endian ordering).· Tools can be run on a live UNIX system during Incident Response.· These tools will show files that have been "hidden" by rootkits and will not modify the A-Time of files that are viewed.Search Techniques:· List allocated and deleted ASCII and Unicode file names.· Display the details and contents of all NTFS attributes (including all Alternate Data Streams).· Display file system and meta-data structure details.· Create time lines of file activity, which can be imported into a spread sheet to create graphs and reports.· Lookup file hashes in a hash database, such as the NIST NSRL, Hash Keeper, and custom databases that have been created with the 'md5sum' tool.· Organize files based on their type (for example all executables, jpegs, and documents are separated). Pages of thumbnails can be made of graphic images for quick analysis.What's New in This Release:· This version contains some bug fixes and other improvements. Many of the changes will be noticeable only if you use the TSK library. The ISO9660 code got a review and update. The HFS+ code is still not enabled by default, but it is now easier to enable and it has a few bug fixes in it.

The Sleuth Kit Related Software