Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
The Sleuth Kit
open-in-new
<h2 id="tools">Tools</h2> <p>Some of the tools included in The Sleuth Kit include<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a>: </p> <ul><li>ils lists <a href="/facts/File_system/FdPm90uc">filesystem metadata</a> entries, such as <a href="/facts/Inode/Ej7JIzyP">Inodes</a>.</li> <li>blkls displays data blocks within a <a href="/facts/Comparison_of_file_systems/M7ynsI2z">file system</a> (formerly called dls).</li> <li>fls lists file names (including names corresponding to hidden or deleted files that have not yet been overwritten) within a file system.</li> <li>fsstat displays statistical information about a file system.</li> <li>ffind searches for file names that point to a specified metadata entry.</li> <li>mactime creates a timeline of all files based upon their <a href="/facts/MAC_times/SU7bb5hR">MAC times</a>.</li> <li>disk_stat (currently Linux-only) discovers the existence of a <a href="/facts/Host_Protected_Area/pxqPNGMe">Host Protected Area</a>.</li></ul> <h2 id="applications">Applications</h2> <p>The Sleuth Kit can be used </p> <ul><li>for use in forensics, its main purpose</li> <li>for understanding what data is stored on a disk drive, even if the operating system has removed all metadata.</li> <li>for recovering deleted image files <a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a></li> <li>summarizing all deleted files<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a></li> <li>search for files by name or included keyword <a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a></li> <li>for use by future historians dealing with computer storage devices</li></ul> <h2 id="see-also">See also</h2> <ul> <li>Free and open-source software portal</li></ul> <ul><li><a href="/facts/Autopsy_(software)/BNdIEenl">Autopsy (software)</a> — A graphical user interface to The Sleuth Kit.</li> <li><a href="/facts/CAINE_Linux/YrPxby7b">CAINE Linux</a> − Includes The Sleuth Kit</li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="https://www.sleuthkit.org/sleuthkit/">Official website</a> </li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Parasram, Shiva V. N. (2017). Digital forensics with Kali Linux: perform data acquisition, digital investigation, and threat analysis using Kali Linux tools. Birmingham, UK. ISBN 978-1-78862-957-7. OCLC 1020288734.{{cite book}}: CS1 maint: location missing publisher (link) <a href="978-1-78862-957-7" target="_blank">978-1-78862-957-7</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Altheide, Cory (2011). Digital forensics with open source tools: using open source platform tools for performing computer forensics on target systems: Windows, Mac, Linux, UNIX, etc. Harlan A. Carvey. Burlington, MA: Syngress. ISBN 978-1-59749-587-5. OCLC 713324784. <a href="978-1-59749-587-5" target="_blank">978-1-59749-587-5</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"About". www.sleuthkit.org. Brian Carrier. Retrieved 2016-08-30. <a href="http://www.sleuthkit.org/about.php" target="_blank">http://www.sleuthkit.org/about.php</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>"The Coroner's Toolkit (TCT)". <a href="http://www.porcupine.org/forensics/tct.html" target="_blank">http://www.porcupine.org/forensics/tct.html</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>"File and Volume System Analysis". www.sleuthkit.org. Brian Carrier. Retrieved 2016-08-30. <a href="http://www.sleuthkit.org/sleuthkit/desc.php" target="_blank">http://www.sleuthkit.org/sleuthkit/desc.php</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>"TSK Tool Overview - SleuthKitWiki". wiki.sleuthkit.org. Retrieved 2025-05-14. <a href="https://wiki.sleuthkit.org/index.php?title=TSK_Tool_Overview" target="_blank">https://wiki.sleuthkit.org/index.php?title=TSK_Tool_Overview</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>"Autopsy: Lesson 1: Analyzing Deleted JPEGs". www.computersecuritystudent.com. Retrieved 2020-06-20. <a href="https://www.computersecuritystudent.com/FORENSICS/AUTOPSY/lesson1/index.html" target="_blank">https://www.computersecuritystudent.com/FORENSICS/AUTOPSY/lesson1/index.html</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>"FS Analysis - SleuthKitWiki". wiki.sleuthkit.org. Retrieved 2020-06-20. <a href="https://wiki.sleuthkit.org/index.php?title=FS_Analysis" target="_blank">https://wiki.sleuthkit.org/index.php?title=FS_Analysis</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>"The Sleuth Kit - analyze disk images and recover files". LinuxLinks. Retrieved 2020-06-20. <a href="https://www.linuxlinks.com/thesleuthkit/" target="_blank">https://www.linuxlinks.com/thesleuthkit/</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> </ol>