Hello, aspiring Cyber Forensic Investigators. In our previous blogpost, you learnt about Computer Forensics. In this article, you will learn about Sleuth Kit, a tool that plays an important role in Open-Source Forensics. In the world of digital forensics, few tools are as powerful, dependable and widely used as The Sleuth Kit (TSK). Whether you’re analyzing deleted files, investigating compromised systems or learning forensic fundamentals, TSK provides a complete set of command-line tools that let investigators examine disk images at a deep, forensic level.
TSK is the main engine behind the popular Autopsy GUI, but even on its own, it’s a fast, flexible and scriptable toolkit preferred by many forensic analysts. For beginners learning how file systems work under the hood, The Sleuth Kit is an excellent starting point. This blogpost introduces TSK’s core capabilities, explains its workflow and provides beginner-friendly commands you can try in your own forensic lab.
What is The Sleuth Kit?
The Sleuth Kit is an open-source collection of command-line forensic tools used to analyze:
- Disk images
- File systems
- Deleted files
- File metadata
- Partition structures
- Timelines and artifacts
It supports major file systems such as:
- FAT
- NTFS
- EXT (2, 3, 4)
- HFS+
- UFS
TSK is commonly used for:
- Incident response
- File recovery
- Timeline analysis
- Malware investigations
- Deleted data analysis
- Evidence extraction
As Sleuth Kit is CLI-based, investigators can automate workflows, integrate TSK into scripts and even perform extremely detailed low-level analysis.
Installing Sleuth Kit
On Ubuntu, Debian or Kali Linux, Sleuth Kit can be installed using commands shown below.
sudo apt update
sudo apt install sleuthkit
You can verify its successful installation using command shown below.
tsk_recover -V
Basic Workflow of TSK
TSK provides multiple tools for each stage of forensic analysis. For beginners, the workflow generally looks like this:
- Identifying partitions
- Inspecting File Systems
- Listing files and directories
- Extracting or recovering files
- Building timeline for analysis
Let’s learn about each of these steps using actual commands.
STEP 1: Identifying Partitions
To view a disk image’s partition layout, use command:
mmls image.dd
This command displays:
- Partition types
- Start and end sectors
- Offsets needed for further analysis
Example output:
DOS Partition Table
Slot Start End Length Description
00: 0000000000 0000204799 204800 NTFS Boot
01: 0000204800 1000000000 ... NTFS Partition
Alwyas keep the Start sector handy, you’ll use it while running other commands.
STEP 2: Inspecting the File System
To get information like file system metadata (like block sizes and type), we can use the command shown below.
fsstat -o 204800 image.dd
where “-o” means offset, in sectors (from the mmls output).
This command helps you verify you’re examining the correct partition.
STEP 3: Listing Files and Directories
To view contents of the directory (NTFS example), you should use command shown below.
fls -o 204800 image.dd
If you want to view this information with detailed metadata, use command shown below.
fls -r -o 204800 image.dd
Where “-r” stands for recursive, showing all subdirectories.
Here’s an example output for this command:
d/d 4: $AttrDef
r/r 5: bootmgr
d/d 6: Users
STEP 4: Extracting or recovering files
Let’s say you identify a file with inode number 128-32. You can recover it using command shown below.
icat -o 204800 image.dd 128-32 > recovered-file.txt
Where “-icat” extracts the raw content of a file from the disk image. This is especially useful for deleted files that don’t appear in the directory listing. You can also recover all files from the partition instead of recovering single files. For this, you can use command:
tsk_recover -o 204800 image.dd output_directory/
This command extracts:
- Existing files
- Deleted files (if not overwritten)
- Directory structure
which is great for full-case evidence collection.
STEP 6: Building Timeline for analysis
TSK is famous for its timeline capabilities. First, you need to generate a body file which can be done using command shown below.
fls -m / -r -o 204800 image.dd > bodyfile.txt
Then, use the “mactime” tool to create a readable timeline.
mactime -b bodyfile.txt > timeline.csv
on opening the timeline.csv file, you can see:
- File creation times
- File modification times
- Access timestamps etc
How to Recover Deleted Files?
You can easily identify deleted files with TSK using command shown below.
fls -o 204800 image.dd | grep deleted
Then, you can extract these files with “icat” just like normal files. Here is an example of Deleted file metadata (NTFS example).
istat -o 204800 image.dd 128-32
This command will display timestamps, file flags and cluster allocations.
Why Investigators Prefer Sleuth Kit?
There are many reasons investigators prefer Sleuth Kit in their investigation. Some of them are,
1. Deep, low -level access:
Using Sleuth Kit, you can inspect raw file system structures, something most GUI tools often hide.
2. Ability to Automate:
Sleuth Kit gives you ability to automate which is perfect for forensic scripts, training labs and large cases.
3. Trustworthy and Open-Source:
Its is open-source and is trusted by law enforcement, academia and corporate IR teams worldwide.
4. Works with any disk image format:
Sleuth Kit works with any disk image format like E01, dd, raw or partition dumps.
Conclusion
The Sleuth Kit is one of the most important tools in digital forensics. For beginners, it offers hands-on insights into how file systems work, how data is stored and how deleted files can still be recovered. Whether you’re analyzing a compromised system or building your first forensic lab, mastering TSK is a key step toward becoming a skilled digital forensic analyst. Don’t like CLI? Learn about its GUI alternative, Autopsy.
