sleuthkit

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.

A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.

Forensic Analysis Tool for Btrfs File System.

A series of Linux and Windows based Forensics labs. Tools used include: FTK, EnCase, Sleuthkit, Autopsy, Volatility, etc.

A hands-on, 8-part Capture the Flag (CTF) curriculum covering cryptography, web exploitation, networking, digital forensics, and reverse engineering.

A fork of The Sleuthkit with XFS filesystem support. See PR https://github.com/sleuthkit/sleuthkit/pull/1476 for more info.

Collection of popular DFIR tools in a lightweight and fast docker image

NBTempoW V. 2.1 is a forensic tool for making timelines from block devices image files (raw, ewf,physicaldrive, etc.). It uses TSK (The Sleuthkit) and it has been developed with Lazarus V. 1.6.2 ( Delphi compatible cross-platform IDE for Rapid Application Development). It runs only in Windows. If the device image file is splitted, you can select…

🕵️‍♂️ Unlock the story hidden in data - Your digital investigation partner. TheSleuthKit (TSK) Python Wrapper.

Python tool to extract File slacks from disk images.

🕵️ An AI-powered forensic orchestration engine for automated disk and memory analysis. Bridges the gap between raw data and actionable intelligence using LLMs (DeepSeek/OpenRouter).

Linux command line thumbstick file recovery script using SleuthKit

A Bash script that utilizes The Sleuth Kit to recover directories in their entirety

Recover normal and deleted files from a partition

Forensic Inode Analysis

Provide a curated set of digital forensics and incident response tools for Linux, MacOS, memory, and mobile investigations.

Use Autopsy Tool in Dark Mode

Open-source forensic imaging & file-carving suite that recovers 40+ formats (JPEG, PNG, PDF, DOCX, MP4, ZIP, WAV, etc.) from raw disks, USB sticks, SD cards or disk-images. Creates bit-for-bit copies, SHA-256/MD5/SHA-1 triple hashes, logs chain-of-custody, exports deleted entries via The Sleuth Kit and performs multi-threaded signature-based .

Removes Claude Code cyber safety checks in source for security research and testing