The Sleuth Kit

The Sleuth Kit
Original author(s)Brian Carrier
Stable release
4.12.1[1] / 29 August 2023; 16 months ago (29 August 2023)
Repository
Written inC, Perl
Operating systemUnix-like, Windows
TypeComputer forensics
LicenseIPL, CPL, GPL
Websitewww.sleuthkit.org/sleuthkit/ Edit this on Wikidata

The Sleuth Kit (TSK) is a library and collection of Unix- and Windows-based utilities for extracting data from disk drives and other storage so as to facilitate the forensic analysis of computer systems. It forms the foundation for Autopsy, a better known tool that is essentially a graphical user interface to the command line utilities bundled with The Sleuth Kit.[2][3]

The collection is open source and protected by the GPL, the CPL and the IPL. The software is under active development and it is supported by a team of developers. The initial development was done by Brian Carrier[4] who based it on The Coroner's Toolkit. It is the official successor platform.[5]

The Sleuth Kit is capable of parsing NTFS, FAT/ExFAT, UFS 1/2, Ext2, Ext3, Ext4, HFS, ISO 9660 and YAFFS2 file systems either separately or within disk images stored in raw (dd), Expert Witness or AFF formats.[6] The Sleuth Kit can be used to examine most Microsoft Windows, most Apple Macintosh OSX, many Linux and some other UNIX computers.

The Sleuth Kit can be used via the included command line tools, or as a library embedded within a separate digital forensic tool such as Autopsy or log2timeline/plaso.

Tools

Some of the tools included in The Sleuth Kit include:

  • ils lists all metadata entries, such as an Inode.
  • blkls displays data blocks within a file system (formerly called dls).
  • fls lists allocated and unallocated file names within a file system.
  • fsstat displays file system statistical information about an image or storage medium.
  • ffind searches for file names that point to a specified metadata entry.
  • mactime creates a timeline of all files based upon their MAC times.
  • disk_stat (currently Linux-only) discovers the existence of a Host Protected Area.

Applications

The Sleuth Kit can be used

  • for use in forensics, its main purpose
  • for understanding what data is stored on a disk drive, even if the operating system has removed all metadata.
  • for recovering deleted image files [7]
  • summarizing all deleted files[8]
  • search for files by name or included keyword [9]
  • for use by future historians dealing with computer storage devices

See also

References

  1. ^ "Release 4.12.1". 29 August 2023. Retrieved 19 September 2023.
  2. ^ Parasram, Shiva V. N. (2017). Digital forensics with Kali Linux: perform data acquisition, digital investigation, and threat analysis using Kali Linux tools. Birmingham, UK. ISBN 978-1-78862-957-7. OCLC 1020288734.{{cite book}}: CS1 maint: location missing publisher (link)
  3. ^ Altheide, Cory (2011). Digital forensics with open source tools: using open source platform tools for performing computer forensics on target systems: Windows, Mac, Linux, UNIX, etc. Harlan A. Carvey. Burlington, MA: Syngress. ISBN 978-1-59749-587-5. OCLC 713324784.
  4. ^ "About". www.sleuthkit.org. Brian Carrier. Retrieved 2016-08-30.
  5. ^ "The Coroner's Toolkit (TCT)".
  6. ^ "File and Volume System Analysis". www.sleuthkit.org. Brian Carrier. Retrieved 2016-08-30.
  7. ^ "Autopsy: Lesson 1: Analyzing Deleted JPEGs". www.computersecuritystudent.com. Retrieved 2020-06-20.
  8. ^ "FS Analysis - SleuthKitWiki". wiki.sleuthkit.org. Retrieved 2020-06-20.
  9. ^ "The Sleuth Kit - analyze disk images and recover files". LinuxLinks. Retrieved 2020-06-20.


Stub icon

This free and open-source software article is a stub. You can help Wikipedia by expanding it.

Read other articles:

قوة الشرطة الاحتياطية المركزية

قوة الشرطة الاحتياطية المركزية البلد الهند  تاريخ التأسيس 1939  الموقع الرسمي الموقع الرسمي  تعديل مصدري - تعديل   قوة الشرطة الاحتياطية المركزية (CRPF ) هي أكبر قوات الشرطة المسلحة المركزية في الهند. وهي تعمل تحت رعاية وزارة الشؤون الداخلية (MHA) التابعة لحكومة الهند. �...

 

951 غاسبرا

951 غاسبرا  صورة ناسا لغاسبرا. الألوان مبالغ فيها الاكتشاف المكتشف غريغوري نويمين  موقع الاكتشاف موقع_الاكتشاف تاريخ الاكتشاف 30 يوليو 1916  سمي باسم غاسبرا  الأسماء البديلة 1916 S45،  و1955 MG1،  وA913 YA،  وA916 OJ  فئةالكوكب الصغير حزام الكويكبات  الأوج 2.593165552006592 و�...

 

Bonvesin de la Riva

Bonvesin de la Riva, a volte italianizzato in Bonvesino, Bonvicino o Buonvicino (Milano (?), 1250 circa – Milano, 1313/1315), è stato uno scrittore e poeta italiano. La sua produzione letteraria annovera testi poetici e prosastici in lingua latina e in volgare lombardo. È considerato infatti il padre della lingua lombarda. Indice 1 Il nome 2 Biografia 3 Opere in volgare lombardo 3.1 La lingua dei volgari di Bonvesin 3.2 I volgari 3.3 La cronologia delle opere volgari di Bonvesin 4 Opere i...

Neville Longbottom

Neville Longbottom Matthew Lewis sebagai Neville Longbottom dalam film Harry Potter and The Order of PhoenixPemeranMatthew LewisAsramaGryffindorInformasiNama lengkapNeville LongbottomKeluargaFrank Longbottom (ayah) Alice Longbottom (ibu) Neville Longbottom (lahir pada tanggal 30 Juli 1980) adalah karakter fiksi dalam seri Harry Potter karangan J. K. Rowling. Neville adalah murid Hogwarts yang ditempatkan di Asrama Gryffindor, dan memiliki ingatan yang parah sekali dan merupakan murid tersial,...

 

3 Maccabees

Ancient Greek text Hebrew Bible (Judaism) Torah (Instruction)GenesisBereshitExodusShemotLeviticusWayiqraNumbersBemidbarDeuteronomyDevarim Nevi'im (Prophets) Former JoshuaYehoshuaJudgesShofetimSamuelShemuelKingsMelakhim Latter IsaiahYeshayahuJeremiahYirmeyahuEzekielYekhezqel Minor Hosea Joel Amos Obadiah Jonah Micah Nahum Habakkuk Zephaniah Haggai Zechariah Malachi Ketuvim (Writings) Poetic PsalmsTehillimProverbsMishleiJobIyov Five Megillot (Scrolls) Song of SongsShir HashirimRu...

 

1889 in India

India-related events in the year 1889 ← 1888 1887 1886 1889 in India → 1890 1891 1892 Centuries: 17th 18th 19th 20th 21st Decades: 1860s 1870s 1880s 1890s 1900s See also:List of years in IndiaTimeline of Indian history Events in the year 1889 in India. Incumbents Empress of India – Queen Victoria Viceroy of India – Henry Petty-Fitzmaurice, 5th Marquess of Lansdowne Nawab of Rampur — Hamid Ali Khan of Rampur Events Phulmoni Dasi rape case, case involving the death of a 10-yea...

Patrick Dehm

Patrick DehmDehm in 2012Born1962 (age 61–62)FreigerichtEducationUniversity of WürzburgOccupations Theologian Gestalt therapist Music publisher Organizations Diocese of Limburg Dehm Verlag Eugen-Dehm-Stiftung inTAKT Patrick Dehm (born 1962) is a German Catholic theologian, supervisor and clinical Gestalt therapist. He and his brother founded the Eugen Dehm foundation, supporting a holistic health concept, in memory of their father. Dehm is director of the Dehm Verlag publishing mus...

 

Wes Anderson

Wes AndersonAnderson di Festival Film Berlin (2018)LahirWesley Wales Anderson1 Mei 1969 (umur 55)Houston, Texas, Amerika SerikatTempat tinggalParis, PrancisAlmamaterUniversitas Texas di Austin (BA)Pekerjaan Sutradara film produser penulis skenario pembuat animasi Tahun aktif1994–sekarangPasanganJuman MaloufAnak1 Wesley Wales Anderson (lahir 1 Mei 1969) adalah seorang pembuat film asal Amerika Serikat. Film-filmnya terkenal karena keunikan gaya visual dan narasi,[1] serta ...

 

SPEF2

SPEF2 المعرفات الأسماء المستعارة SPEF2, CT122, KPL2, sperm flagellar 2, SPGF43 معرفات خارجية الوراثة المندلية البشرية عبر الإنترنت 610172 MGI: MGI:2443727 HomoloGene: 23371 GeneCards: 79925 نمط التعبير عن الحمض النووي الريبوزي المزيد من بيانات التعبير المرجعية أورثولوج الأنواع الإنسان الفأر أنتريه 79925 320277 Ensembl ENSG0000015258...

Guerra seminole (1835-1842)

Seconda guerra seminoleparte Guerre SeminoleOsceola, comandante dei SeminoleData1835 - 1842 LuogoFlorida EsitoNetta vittoria statunitense. 3.800 Seminole vengono trasferiti nel territorio indiano; 300 vengono lasciati nelle Everglades. Modifiche territorialiOccupazione statunitense della Florida. Schieramenti Stati UnitiSeminole ComandantiAndrew JacksonMartin Van BurenWilliam Henry HarrisonJohn TylerDuncan Lamont ClinchWinfield Scott (1836)Richard Keith Call (1836)Thomas S. Jesup (1836-38)Zac...

 

Palmese 1914

Questa voce o sezione sull'argomento società calcistiche italiane non cita le fonti necessarie o quelle presenti sono insufficienti. Puoi migliorare questa voce aggiungendo citazioni da fonti attendibili secondo le linee guida sull'uso delle fonti. USD Palmese 1914Calcio I Rossoneri, Le Furie Rossonere Segni distintiviUniformi di gara Casa Trasferta Terza divisa Colori sociali Rosso pompeiano, nero SimboliCastello di Palma Campania InnoAlè Palmese alè!Anonimo Dati societariCittàPalm...

 

Hauptstraße (Radebeul)

Die Hauptstraße ist eine Innerortsstraße in der sächsischen Stadt Radebeul, in den Stadtteilen Alt-Radebeul und Oberlößnitz. Sie stellt die Verbindung dar zwischen dem Robert-Werner-Platz und damit dem historischen Dorfkern von Radebeul (Am Kreis) und der wichtigsten Längsachse von Radebeul, der Meißner Straße. Die Hauptstraße als Querstraße zur Meißner Straße stellt nach dem Radebeuler Zentrenkonzept die Einkaufs- und damit die Hauptstraße von Radebeul-Ost dar, so wie dies für ...

United Kingdom Hydrographic Office

UK government agency concerned with providing hydrographic and marine geospatial data United Kingdom Hydrographic OfficeAgency overviewFormed1795HeadquartersAdmiralty Way Taunton TA1 2DNEmployeesapprox 900Minister responsibleThe Baroness GoldieAgency executiveRear Admiral Peter Sparkes, Chief Executive[1][2]Parent agencyMinistry of DefenceWebsitegov.uk/ukho The United Kingdom Hydrographic Office (UKHO) is the UK's agency for providing hydrographic and marine geospatial data to...

 

Декандоль, Альфонс

В Википедии есть статьи о других людях с фамилией Декандоль. Альфонс Луи Пьер Пирамю Декандольфр. Alphonse Louis Pierre Pyramus de Candolle Имя при рождении фр. Alphonse-Louis-Pierre-Pyramus de Candolle Дата рождения 27 октября 1806(1806-10-27) Место рождения Париж, Франция Дата смерти 4 апреля 1893(1893-04-04) (86 л�...

 

赤斤蒙古卫

明朝关西八卫 赤斤蒙古卫，明朝关西八卫之一，简称赤斤卫，又作赤金卫。 明朝 明朝永乐二年（1404年）元朝丞相苦术之子塔力尼投降明朝，以其所部在赤斤站设置赤斤蒙古千户所，在今甘肃省玉门市西北赤金堡。永乐八年（1410年）升为赤斤卫，正德年间被吐鲁番汗国所破，当地人内徙肃州的南山，赤斤城空。 清朝 清圣祖康熙五十七年（1718年），恢复赤金卫，清世宗雍正...

Elasmotherium

Elasmotherium Periode Miosen Akhir sampai Pleistosen Akhir, 7–0.039 jtyl PreЄ Є O S D C P T J K Pg N Rekonstruksi kerangka E. caucasicum, Azov History, Archaeology and Paleontology Museum-Reserve [fr]TaksonomiKelasMammaliaOrdoPerissodactylaFamiliRhinocerotidaeGenusElasmotherium J. Fischer, 1808[1] Tipe taksonomi †Elasmotherium sibiricum Tata namaSinonim takson Stereoceros Enigmatherium E. fischeri = E. sibiricum E. inexpectatum = E. caucasicum Spesies lain †E...

 

مغاربة يهود

مغاربة يهودالتعداد الكليالتعداد يتجاوز المليونمناطق الوجود المميزة  إسرائيل 900,000 [1]  فرنسا 150,000  كندا 20,000  إسبانيا 10,000  الولايات المتحدة 10,000  المغرب 3,000[1]  إسرائيل 900,000 [2]  فرنسا 150,000  كندا 20,000  إسبانيا 10,000  الولايات المتحدة 10,000  المغرب 3,000[...

 

تريلوفون (ثيسالونيكي)

تريلوفون (ثيسالونيكي) تقسيم إداري البلد اليونان  [1] خصائص جغرافية إحداثيات 40°28′08″N 22°58′18″E / 40.46898°N 22.9718°E / 40.46898; 22.9718   الارتفاع 141 متر  السكان التعداد السكاني 3384 (resident population of Greece) (2001)1850 (resident population of Greece) (1991)6557 (resident population of Greece) (2021)7227 (resident population of Gree...

乙型线状病毒科

乙型线状病毒科 病毒分類 （未分级）： 病毒 Virus 域： 核糖病毒域 Riboviria 界： 正核糖病毒界 Orthornavirae 门： 黃色病毒門 Kitrinoviricota 纲： 阿爾法超群病毒綱 Alsuviricetes 目： 芜菁黄花叶病毒目 Tymovirales 科： 乙型线状病毒科 Betaflexiviridae 属 见正文 乙型线状病毒科（学名：Betaflexiviridae）是芜菁黄花叶病毒目下的一个科。 下属分类 本科包括以下属：[1] Capillovirus 香石�...

 

سباستيان هيناو

سباستيان هيناو   معلومات شخصية اسم الولادة (بالإسبانية: Sebastián Henao Gómez)‏  الميلاد 5 أغسطس 1993 (31 سنة)  ريونيغرو  الطول 171 سنتيمتر  الجنسية كولومبيا  الوزن 57 كيلوغرام  الحياة العملية الفرق فريق إنيوس (2014–2021)فريق أستانا (1 يناير 2022–31 يوليو 2022)  المهنة دراج  ن...