The Sleuth Kit
Developed by Brian Carrier (open source)Free command-line tools to examine file systems and recover deleted files from disk images.
Links open the official website of Brian Carrier (open source). Data Recovery Mumbai is not the developer of this software.
What is The Sleuth Kit?
The Sleuth Kit is a free collection of command-line tools that analyse disk images and file systems, list deleted files, recover them and build timelines. It is the engine behind Autopsy.
It suits examiners who prefer scripts and fine control over a graphical program.
Best for
- Command-line examiners
- Scripted analysis
- Learning file-system forensics
Quick facts
- Developer
- Brian Carrier (open source)
- Category
- Forensic
- Platforms
- Windows, Linux, macOS
- Licence
- 100% Free
- Website
- sleuthkit.org
What The Sleuth Kit can do
File-system analysis
NTFS, FAT, exFAT, ext, HFS and more.
Deleted files
List and recover deleted entries.
Timelines
Build activity timelines.
Image formats
Works with raw and E01 images.
Open source
Free to use.
Using it in 3 steps
-
1
Protect the evidence
Connect the drive through a hardware write blocker.
-
2
Create an image
Make a verified forensic image with hash values.
-
3
Analyse & report
Examine the image (never the original) and document findings.
Pros & Cons
Pros
- Free and open source
- Precise control
- Scriptable
Cons
- Command-line only
- Steep learning curve
System requirements
- Runs on: Windows, Linux, macOS
- A hardware write blocker for original evidence drives
- Check the official website for the latest version and full system requirements
Professional recovery in our Class 100 clean-room lab
| DIY software | Data Recovery Mumbai | |
|---|---|---|
| Deleted / formatted files | ||
| Clicking / dead hard disk | ||
| Burnt PCB / firmware fault | ||
| Dead SSD / RAID / server | ||
| Free diagnosis, no data – no charge | — |
The Sleuth Kit FAQ
Questions we often hear from customers who tried this software first.
The Sleuth Kit is a product of Brian Carrier (open source). Data Recovery Mumbai is an independent data recovery lab and is not affiliated with the developer. All trademarks belong to their owners. Information is for guidance; check the official website for current features and prices.