The Sleuth Kit

The Sleuth Kit (TSK) is a <a href="/facts/Open-source_software/HzTaB8E9">open-source</a> <a href="/facts/Library_(computing)/xRzL3P7q">library</a> and collection of utilities for <a href="/facts/Unix-like/YAKrAxzd">Unix-like</a> operating systems and <a href="/facts/Microsoft_Windows/bwhAhuSL">Windows</a> that is used for extracting and parsing data from disk drives and other computer <a href="/facts/Data_storage/uCvJ6nrq">data storage devices</a> so as to facilitate the <a href="/facts/Computer_forensics/g59dDNYz">forensic analysis of computer systems</a>. It forms the foundation for <a href="/facts/Autopsy_(software)/BNdIEenl">Autopsy</a>, a better known tool that is essentially a graphical user interface to the command line utilities bundled with The Sleuth Kit. 
The software is under active development and it is supported by a team of developers. The initial development was done by Brian Carrier who based it on <a href="/facts/The_Coroner%2527s_Toolkit/kTxJP58P">The Coroner's Toolkit</a>. It is the official successor platform. 
The Sleuth Kit is capable of parsing <a href="/facts/NTFS/dryNM3BK">NTFS</a>, <a href="/facts/File_Allocation_Table/uFvpmWxa">FAT</a>, <a href="/facts/ExFAT/w9R3QhPC">ExFAT</a>, <a href="/facts/Unix_File_System/wDMLrTPe">UFS</a> versions 1 and 2, <a href="/facts/Ext2/ftyVw4Kv">Ext2</a>, <a href="/facts/Ext3/VSEhX1WQ">Ext3</a>, <a href="/facts/Ext4/zFbQRpsh">Ext4</a>, <a href="/facts/HFS_Plus/sWk14kM5">HFS</a>, <a href="/facts/ISO_9660/zAEVMFnu">ISO 9660</a> and <a href="/facts/YAFFS/VhnDVRcG">YAFFS2</a> file systems either on disk or within whole disk or <a href="/facts/Disk_partitioning/wrBk5RRS">disk partition</a> images stored in raw form (as can be obtained with <a href="/facts/Dd_(Unix)/Ksttbob5">dd</a>), or Expert Witness or AFF formats. The Sleuth Kit can be used to examine the contents of most computers that run <a href="/facts/Microsoft_Windows/bwhAhuSL">Microsoft Windows</a>, <a href="/facts/MacOS/Y93vVpTm">macOS</a>, or <a href="/facts/Linux/9FvCKSTq">Linux</a> and some other computers which run derivatives of <a href="/facts/Unix/0pNL2seI">Unix</a> such as the <a href="/facts/List_of_BSD_operating_systems/VtxhWWqd">BSDs</a> or <a href="/facts/Oracle_Solaris/KPfT98EJ">Solaris</a>.
The Sleuth Kit can be used via the included <a href="/facts/Command-line_interface/R9JpGmXQ">command line tools</a>, or as a library embedded within a separate digital forensic tool such as <a href="/facts/Autopsy_(software)/BNdIEenl">Autopsy</a> or log2timeline/plaso.

The Sleuth Kit open-in-new

The Sleuth Kit