- Home
- Computer Forensics Software
- The Sleuth Kit
The Sleuth Kit
What it is
The Sleuth Kit is a C library and command-line toolkit for examining disk images, volumes, and file-system data. Its tools can list allocated and deleted file names, inspect NTFS attributes, show file-system metadata, and build file activity timelines. They analyze file systems without relying on the host operating system to process them, which can reveal deleted and hidden content. Supported image types include raw, E01, VHD, VMDK, and AFF; listed file systems include NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2. Hash lookup can use NIST NSRL, Hash Keeper, and custom databases. The C library can be incorporated into larger forensic tools, and the toolkit powers Autopsy and other open-source and commercial forensic tools. Listed systems include Linux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, and Solaris. The toolkit is free, but its source files use several licenses. Volunteer-maintained projects offer forums and email lists for community assistance; commercial support is available from Sleuth Kit Labs.
For and against
For
- Lists allocated and deleted file names.
- Supports raw, E01, VHD, VMDK, and AFF images.
- Can create file-activity timelines and inspect metadata.
- Hash lookup supports NIST NSRL, Hash Keeper, and custom databases.
- Available across listed Windows and Unix systems.
Against
- Source files use several different licenses.
- Community projects are maintained by volunteers.
- Commercial support is available from Sleuth Kit Labs.
The verdict
The Sleuth Kit provides detailed disk-image and file-system analysis tools, plus a library for integration into larger applications. Review the licensing across source files and choose the appropriate community or commercial support route.
Who it suits
The Sleuth Kit suits digital forensics practitioners and developers building tools that analyze disk images or file-system data. Its command-line tools and C library offer different ways to use its analysis capabilities.
Plans and prices
The Sleuth Kit
Open source forensic tools and C library
Read 9 Oct 2026 · sleuthkit.org
On the record
- Analysis features
- The tools can list allocated and deleted file names, inspect NTFS attributes, show file system metadata, and create file activity timelines.sleuthkit.org · read 9 Oct 2026
- Development
- Users can report bugs through the project bug tracker and submit code contributions under the developer guidelines.sleuthkit.org · read 9 Oct 2026
- Disk formats
- It analyzes raw, E01, VHD, VMDK, and AFF file system and disk images.sleuthkit.org · read 9 Oct 2026
- Download
- The download page lists version 4.14.0 dated April 15, 2025, with source code and Windows binaries.sleuthkit.org · read 9 Oct 2026
- File recovery
- Its file system tools examine file systems without relying on the host operating system to process them, allowing deleted and hidden content to be shown.sleuthkit.org · read 9 Oct 2026
- File systems
- Listed file system support includes NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2.sleuthkit.org · read 9 Oct 2026
- Hash lookup
- The toolkit can look up file hashes in databases including NIST NSRL, Hash Keeper, and custom databases.sleuthkit.org · read 9 Oct 2026
- Integrations
- The C library can be incorporated into larger digital forensics tools, and The Sleuth Kit powers Autopsy and other open source and commercial forensic tools.sleuthkit.org · read 9 Oct 2026
- License
- Source files use several licenses; the core code is under the IBM Public License or Common Public License, and other utilities are not GPL or copyleft, with a standalone GNU strings copy under GPL 2.sleuthkit.org · read 9 Oct 2026
- Purpose
- The Sleuth Kit is a C library and command-line tools for investigating disk images and analyzing volume and file system data.sleuthkit.org · read 9 Oct 2026
- Security note
- The description says the live Windows or UNIX tools can show files hidden by rootkits and do not modify the access time of files viewed.sleuthkit.org · read 9 Oct 2026
- Support
- The projects are maintained by volunteers, with user forums and email lists for community help and commercial support available from Sleuth Kit Labs.sleuthkit.org · read 9 Oct 2026
- Supported systems
- The site says it runs on Windows and Unix platforms and lists testing on Linux, Mac OS X, Windows, Cygwin, Open and FreeBSD, and Solaris.sleuthkit.org · read 9 Oct 2026
