The Sleuth Kit (TSK) is an open-source command-line digital forensics toolkit for analyzing disk images and file systems at a low level. It is the modern successor to The Coroner’s Toolkit (TCT) and provides significantly expanded file system support and functionality.
Supported File Systems
- Windows: NTFS, FAT (12/16/32), exFAT
- Linux: EXT (2/3/4), XFS
- macOS: HFS+
- Unix: UFS (1/2)
Key Functions & Tools
| Tool | Description |
|---|---|
| File System Layer | |
fsstat | Displays file system details (layout, size, metadata structures). |
fls | Lists files and directories, including deleted entries, from a disk image. |
istat | Displays detailed metadata (inode/MFT entry) for a specific file or directory. |
icat | Extracts the content of a file using its inode or MFT reference number (useful for recovering deleted files). |
find | Similar to Unix find, but operates on the image and can filter by timestamps, size, or inode values. |
| File Content Layer | |
blkcalc | Converts between file system block addresses and disk sector addresses. |
blkls | Extracts unallocated space (data not assigned to any file) and outputs it for analysis or carving. |
dls | List unallocated disk blocks (data not assigned to a file system). |
sorter | Classifies files by type (e.g., images, documents, executables) based on file signatures, or filters by extension. |
| Timeline & Search | |
mactime | Generates a timeline of file system events (MAC: modification, access, change) from a body file. |
hfind | Performs hash lookups against databases (e.g., NIST NSRL) to identify known files. |
sigfind | Searches for a specific binary pattern (like a file signature) within the image. |
Basic Workflow
- Obtain a forensic image (
ddordcfldd). - Use
fsstatto confirm the file system structure. - Run
flsto list files and note deleted entries. - Use
istaton suspicious inodes for metadata (timestamps, size). - Extract deleted files with
icat. - Generate a
mactimetimeline for activity mapping. - Extract unallocated space (
blkls) and run carving tools likeforemostorscalpel.
Important Notes
- TSK is a command-line toolkit, but the Autopsy GUI provides a web interface over TSK.
- All TSK tools operate on a forensic image (E01, dd, raw) and should not be run on a mounted live system.
- It is cross-platform: Linux, macOS, and Windows (via Cygwin or WSL).
- Development is active, with regular updates for newer file system versions.