The Sleuth Kit

What it is

A C library and command-line tools for examining volume and file system data inside disk images. It supports common file systems and can list, extract, and timeline files without mounting the image.

What it helps with

- Listing and extracting files from forensic disk images
- Building timelines of file system activity
- Scripting batch analysis of many images
- Powering GUI tools that sit on top of the library

Who it's for

Digital forensics examiners, incident responders, and researchers analyzing disk evidence.

Worth knowing

Licensing is mixed across the tree, with OSI licenses on the core components. Autopsy is the widely used graphical interface built on The Sleuth Kit.

Do I need Autopsy to use it?
No, the command-line tools stand alone, and Autopsy is optional when you want a GUI.

Does it analyze memory dumps?
No, it focuses on disk and file system images; memory work is better left to Volatility.