StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.Sleuth Kit Labs
The Sleuth Kit
The Sleuth Kit, usually written TSK, is a C library and a set of command line tools for examining disk images and file systems. Autopsy is its graphical face. Working with TSK directly teaches what the graphical tools hide.
FrameworkOpen sourceCurrentWindows · Linux · macOS
Profile
- Manufacturer
- Sleuth Kit Labs
- Category
- Computer forensics
- Product type
- Framework
- Platforms
- Windows, Linux, macOS
- Licensing
- Open source
- Product status
- Current
- Educational level
- Intermediate
- Last verified
- 2 November 2026
The maker's description page lists the image formats, file systems, volume systems and tested platforms given above. Its licences page states that the core code is under the IBM Public License or the Common Public License, with a stripped-down copy of the GNU strings utility under GPL 2. The site credits Sleuth Kit Labs; no current version number is shown on the pages checked.
What The Sleuth Kit is
TSK reads a disk image and lets the examiner walk through it layer by layer: the partition table, each file system, the metadata entries that describe files and the data blocks that hold their content. Its maker lists raw (dd), E01, VHD, VMDK and AFF images as input, file systems including NTFS, FAT, exFAT, APFS, UFS 1 and 2, Ext2, Ext3, Ext4, HFS, ISO 9660 and YAFFS2. Volume systems cover DOS partitions, BSD disk labels, Mac partitions, Sun slices and GPT. The tools examine a suspect file system without changing it and can build a timeline of file activity.
Because TSK is a library, other software builds on it. Autopsy does, as do many research tools. The command line programs are where students learn the most. Listing files from a file system with their metadata addresses, pulling a deleted file's content by its entry number or extracting unallocated space for carving each shows what a graphical tool does behind one click. The maker says TSK runs on Windows and Unix platforms and has been tested on Linux, macOS, Windows, FreeBSD, OpenBSD and Solaris. The core is released under the IBM Public License and the Common Public License, with a bundled utility under GPL 2.
Primary applications
Where it is used
- Examining a disk image at the partition, file system, metadata and block layers
- Listing allocated and deleted files with their metadata addresses
- Recovering a deleted file's content where its blocks survive
- Building file activity timelines for later review
- Extracting unallocated space for carving with other tools
- Serving as the engine inside Autopsy and research tools
Who uses it
- Students learning file system forensics from first principles
- Researchers and tool developers
- Examiners who need to verify a graphical tool's result by hand
- Linux-based laboratories
Capabilities and limits
Major capabilities
- Reads raw, E01, VHD, VMDK and AFF images
- Supports NTFS, FAT, exFAT, APFS, UFS 1 and 2, Ext2 to Ext4, HFS, ISO 9660 and YAFFS2 file systems
- Handles DOS, BSD, Mac, Sun and GPT volume systems
- Non-intrusive examination of file system and metadata structures
- Timeline creation from file activity
- C library for building into other tools
- Runs on Windows and Unix platforms
Technical limitations
- Command line only; the graphical interface is Autopsy
- No artefact parsing, no mobile extraction and no reporting on its own
- File systems outside its list and newer features inside supported ones may not be fully understood
- Carving and keyword search are done with other tools on the data TSK extracts
Learning with DFRTI
Independent professional education covering the principles and workflows of The Sleuth Kit. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- Command line basics on Windows or Linux
- File system concepts: partitions, metadata entries, blocks and allocation
Disciplines
Related tools
- AutopsyAutopsy is a free, open source examination platform that puts a graphical interface and ingest modules on top of The Sleuth Kit. For a student it is the first tool that shows a whole case from image to report at no cost.Sleuth Kit Labs
- X-Ways ForensicsX-Ways Forensics is the German examination tool that runs light, starts fast and gives the examiner the raw disk alongside the parsed view. Version 21.9 was current when this page was checked.X-Ways Software Technology AG
- Exterro FTK ImagerFTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.Exterro
- Arsenal Image MounterArsenal Image Mounter, or AIM, mounts a disk image in Windows as a complete disk rather than a share, so Windows itself sees partitions, shadow copies and BitLocker volumes. The free mode covers mounting; Professional Mode adds virtual machine launch and more.Arsenal Recon
- PlasoPlaso pulls every timestamp it can recognise out of a disk image or folder and writes them to one storage file. Sorted, that file is the super timeline investigators use to see what happened in what order.log2timeline project
Courses that cover this tool
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.
StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.