The Sleuth Kit (TSK)
Brian Carrier · Sleuth Kit Labs · TSK 4 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A C library and a set of command-line tools (fls, icat, istat, mmls, blkls, tsk_recover and others) that read volume systems and file systems directly from a disk image. It is the engine underneath Autopsy and a component in many other tools.
Who it is for, and when
TSK is what you reach for when you need to show your work at the layer below a GUI: listing directory entries with their metadata addresses, extracting a single file by inode, dumping unallocated space, or scripting the same extraction across hundreds of images. Because each tool does one thing and prints plain text, it is the easiest way to demonstrate a file-system-level assertion in a report or under cross-examination. It also remains the practical route to automation in a pipeline.
What it does not cover
TSK parses file systems; it does not carve by content, does not interpret application artefacts such as browser or registry data, and has no case management or reporting layer. Its file system support is broad but not universal — newer or proprietary formats may need a different reader, and it will not acquire an image for you.
Go to the source
Open at sleuthkit.org (opens in a new tab)https://sleuthkit.org/sleuthkit/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Brian Carrier
- Publisher
- Sleuth Kit Labs
- Version verified
- TSK 4
- Year
- 2026
- Topics
- file-systems, linux, windows, scripting, open-source, evidence-handling
- Checked at source
Related entries
A set of eleven numbered DFIR challenges plus additional memory forensics, unallocated-space and Linux cases published by Ali Hadi, each with the scenario and the evidence to work it. Subjects include a breached web server with both disk image and memory dump, Windows user policy violation, alternate data streams, NTFS hidden-file recovery, browser artefacts, a Sysinternals-abuse malware case, encryption, and anti-forensics and data hiding.
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.
The Volatility Foundation keeps the Volatility Framework — currently Volatility 3 — free and open source on GitHub, with the accompanying project documentation. Separately it endorses instructor-led memory forensics courses; the Foundation's site does not publish prices for those, and the Malware and Memory Forensics class is a commercial offering run through memoryanalysis.net.
A Windows tool that mounts raw, forensic, and virtual machine disk images as complete physical disks rather than as individual volumes, which is what lets Windows and other software treat an image as a real attached drive. It also offers Windows authentication bypass, launching virtual machines from volume shadow copies, and BitLocker handling.
Autopsy
FreeAn open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.