THE SLEUTH KIT (TSK) & AUTOPSY: OPEN SOURCE DIGITALHOMEAUTOPSYTHE SLEUTH KITOTHER PROJECTSSUPPORTABOUT The Sleuth Kit® is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools. These tools are used by thousands of users around the world and have community-based e-mail lists and forums. THE SLEUTH KIT: DOWNLOAD The Sleuth Kit is a C library and collection of open source command line tools for the forensic analysis of NTFS, FAT, EXT2FS, and FFS

file systems

THE SLEUTH KIT: FILE AND VOLUME SYSTEM ANALYSIS Description. The original part of Sleuth Kit is a C library and collection of command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and

hidden

AUTOPSY - SLEUTH KIT Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. THE SLEUTH KIT COMMANDS The TSK 4 command list. blkcalc - Converts between unallocated disk unit numbers and regular disk unit numbers.; blkcat - Display the contents of file system data unit in a disk image.; blkls - List or output file system data units.; blkstat - Display details of a file system data unit (i.e. block or sector).; fcat - Output the contents of a file based on its name.

CASE STUDIES

Case Studies. The Sleuth Kit. Autopsy. mac-robber. Case Studies. The updated list of case studies is being maintained here on the wiki. The following were written as "official" reports for challenges from the Honeynet Project. Scan of the Month #29 - Linux VMWare (September 2003) The Challenge. AUTOPSY: DESCRIPTION

AUTOPSY DOCS

Autopsy is an open source graphical interface to The Sleuth Kit and other digital forensics tools. AUTOPSY TIMELINE ANALYSIS HELP AUTOPSY 3RD PARTY MODULES LEGACY MATERIAL. This page will list the third party modules that have been written for Autopsy. Autopsy comes with a set of modules, but other developers are encouraged go write modules instead of stand-alone tools. Autopsy has many new frameworks and as more modules are written, this page will obviously get longer. THE SLEUTH KIT (TSK) & AUTOPSY: OPEN SOURCE DIGITALHOMEAUTOPSYTHE SLEUTH KITOTHER PROJECTSSUPPORTABOUT The Sleuth Kit® is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools. These tools are used by thousands of users around the world and have community-based e-mail lists and forums. THE SLEUTH KIT: DOWNLOAD The Sleuth Kit is a C library and collection of open source command line tools for the forensic analysis of NTFS, FAT, EXT2FS, and FFS

file systems

THE SLEUTH KIT: FILE AND VOLUME SYSTEM ANALYSIS Description. The original part of Sleuth Kit is a C library and collection of command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and

hidden

AUTOPSY - SLEUTH KIT Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. THE SLEUTH KIT COMMANDS The TSK 4 command list. blkcalc - Converts between unallocated disk unit numbers and regular disk unit numbers.; blkcat - Display the contents of file system data unit in a disk image.; blkls - List or output file system data units.; blkstat - Display details of a file system data unit (i.e. block or sector).; fcat - Output the contents of a file based on its name.

CASE STUDIES

Case Studies. The Sleuth Kit. Autopsy. mac-robber. Case Studies. The updated list of case studies is being maintained here on the wiki. The following were written as "official" reports for challenges from the Honeynet Project. Scan of the Month #29 - Linux VMWare (September 2003) The Challenge. AUTOPSY: DESCRIPTION

AUTOPSY DOCS

Autopsy is an open source graphical interface to The Sleuth Kit and other digital forensics tools. AUTOPSY TIMELINE ANALYSIS HELP AUTOPSY 3RD PARTY MODULES LEGACY MATERIAL. This page will list the third party modules that have been written for Autopsy. Autopsy comes with a set of modules, but other developers are encouraged go write modules instead of stand-alone tools. Autopsy has many new frameworks and as more modules are written, this page will obviously get longer.

THE SLEUTH KIT

The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be

AUTOPSY: INTUITIVE

Intuitive. Digital forensics tools should be intuitive and approachable so that they can be effectively used by non-technical investigators. Autopsy uses wizards to help the investigator know what the next step is, uses common navigation techniques to help them find their results, and tries to automate as much as possible to reduce

errors.

THE SLEUTH KIT: THE SLEUTH KIT (TSK) LIBRARY USER'S GUIDE Author Brian Carrier Overview. This document was designed to help integrate the Sleuth Kit (TSK) C/C++ library into an application that needs to analyze data from a disk image. Note that this document does not contain information about using the command line tools in TSK.

AUTOPSY DOCS

Autopsy is an open source graphical interface to The Sleuth Kit and other digital forensics tools. AUTOPSY: TIMELINE ANALYSIS Timeline analysis is useful for a variety of investigation types and is often used to answer questions about when a computer is used or what events occurred before or after a given event. Autopsy contains an advanced timeline interface that was built with funding from DHS S&T. It pulls timestamp info from the following places: Other Autopsy THE SLEUTH KIT INFORMER Introduction. This 18th issue of The Informer provides a detailed description of the fsstat tool in The Sleuth Kit (TSK). The purpose of this article and future ones like it is to better document some of the TSK tools, especially those that provide large amounts of information. THE SLEUTH KIT: APFS_FILE_EXTENT STRUCT REFERENCE The documentation for this struct was generated from the following file: tsk/fs/tsk_apfs.h MACTIME - SLEUTHKITWIKI mactime reads the body file (using the '-b' argument), which contains a line for each file or event. mactime then sorts the data based on its temporal data and prints the result. It can optionally use a starting date or a date range to limit the data being printed. The following reads body.txt and outputs all activity starting in March of

2002.

THE SLEUTH KIT: HFS_BTREE_KEY_EXT STRUCT REFERENCE The documentation for this struct was generated from the following file: tsk/fs/tsk_hfs.h THE SLEUTH KIT: FATXXFS_DENTRY_LFN STRUCT REFERENCE The documentation for this struct was generated from the following file: tsk/fs/tsk_fatxxfs.h THE SLEUTH KIT (TSK) & AUTOPSY: OPEN SOURCE DIGITALHOMEAUTOPSYTHE SLEUTH KITOTHER PROJECTSSUPPORTABOUT The Sleuth Kit® is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools. These tools are used by thousands of users around the world and have community-based e-mail lists and forums. THE SLEUTH KIT: DOWNLOAD The Sleuth Kit is a C library and collection of open source command line tools for the forensic analysis of NTFS, FAT, EXT2FS, and FFS

file systems

THE SLEUTH KIT: FILE AND VOLUME SYSTEM ANALYSIS Description. The original part of Sleuth Kit is a C library and collection of command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and

hidden

AUTOPSY - SLEUTH KIT Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. THE SLEUTH KIT COMMANDS The TSK 4 command list. blkcalc - Converts between unallocated disk unit numbers and regular disk unit numbers.; blkcat - Display the contents of file system data unit in a disk image.; blkls - List or output file system data units.; blkstat - Display details of a file system data unit (i.e. block or sector).; fcat - Output the contents of a file based on its name.

CASE STUDIES

Case Studies. The Sleuth Kit. Autopsy. mac-robber. Case Studies. The updated list of case studies is being maintained here on the wiki. The following were written as "official" reports for challenges from the Honeynet Project. Scan of the Month #29 - Linux VMWare (September 2003) The Challenge. AUTOPSY: DESCRIPTION

AUTOPSY DOCS

Autopsy is an open source graphical interface to The Sleuth Kit and other digital forensics tools. AUTOPSY TIMELINE ANALYSIS HELP AUTOPSY 3RD PARTY MODULES LEGACY MATERIAL. This page will list the third party modules that have been written for Autopsy. Autopsy comes with a set of modules, but other developers are encouraged go write modules instead of stand-alone tools. Autopsy has many new frameworks and as more modules are written, this page will obviously get longer. THE SLEUTH KIT (TSK) & AUTOPSY: OPEN SOURCE DIGITALHOMEAUTOPSYTHE SLEUTH KITOTHER PROJECTSSUPPORTABOUT The Sleuth Kit® is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools. These tools are used by thousands of users around the world and have community-based e-mail lists and forums. THE SLEUTH KIT: DOWNLOAD The Sleuth Kit is a C library and collection of open source command line tools for the forensic analysis of NTFS, FAT, EXT2FS, and FFS

file systems

THE SLEUTH KIT: FILE AND VOLUME SYSTEM ANALYSIS Description. The original part of Sleuth Kit is a C library and collection of command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and

hidden

AUTOPSY - SLEUTH KIT Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. THE SLEUTH KIT COMMANDS The TSK 4 command list. blkcalc - Converts between unallocated disk unit numbers and regular disk unit numbers.; blkcat - Display the contents of file system data unit in a disk image.; blkls - List or output file system data units.; blkstat - Display details of a file system data unit (i.e. block or sector).; fcat - Output the contents of a file based on its name.

CASE STUDIES

Case Studies. The Sleuth Kit. Autopsy. mac-robber. Case Studies. The updated list of case studies is being maintained here on the wiki. The following were written as "official" reports for challenges from the Honeynet Project. Scan of the Month #29 - Linux VMWare (September 2003) The Challenge. AUTOPSY: DESCRIPTION

AUTOPSY DOCS

Autopsy is an open source graphical interface to The Sleuth Kit and other digital forensics tools. AUTOPSY TIMELINE ANALYSIS HELP AUTOPSY 3RD PARTY MODULES LEGACY MATERIAL. This page will list the third party modules that have been written for Autopsy. Autopsy comes with a set of modules, but other developers are encouraged go write modules instead of stand-alone tools. Autopsy has many new frameworks and as more modules are written, this page will obviously get longer.

THE SLEUTH KIT

The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be THE SLEUTH KIT: FILE AND VOLUME SYSTEM ANALYSIS Description. The original part of Sleuth Kit is a C library and collection of command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and

hidden

AUTOPSY: INTUITIVE

Intuitive. Digital forensics tools should be intuitive and approachable so that they can be effectively used by non-technical investigators. Autopsy uses wizards to help the investigator know what the next step is, uses common navigation techniques to help them find their results, and tries to automate as much as possible to reduce

errors.

AUTOPSY DOCS

Autopsy is an open source graphical interface to The Sleuth Kit and other digital forensics tools. AUTOPSY: TIMELINE ANALYSIS Timeline analysis is useful for a variety of investigation types and is often used to answer questions about when a computer is used or what events occurred before or after a given event. Autopsy contains an advanced timeline interface that was built with funding from DHS S&T. It pulls timestamp info from the following places: Other Autopsy THE SLEUTH KIT: THE SLEUTH KIT (TSK) LIBRARY USER'S GUIDE Author Brian Carrier Overview. This document was designed to help integrate the Sleuth Kit (TSK) C/C++ library into an application that needs to analyze data from a disk image. Note that this document does not contain information about using the command line tools in TSK. THE SLEUTH KIT: LIBRARY BASICS The Sleuth Kit: Library Basics. This page describes some of the basic concepts of the TSK library. It is assumed that you have built and installed the TSK library based on either the instructions in the INSTALL.txt file or via a package. Refer to the files in the samples directory for examples on the topics in this and later sections. THE SLEUTH KIT: APFS_FILE_EXTENT STRUCT REFERENCE The documentation for this struct was generated from the following file: tsk/fs/tsk_apfs.h THE SLEUTH KIT: HFS_BTREE_KEY_EXT STRUCT REFERENCE The documentation for this struct was generated from the following file: tsk/fs/tsk_hfs.h THE SLEUTH KIT: FATXXFS_DENTRY_LFN STRUCT REFERENCE The documentation for this struct was generated from the following file: tsk/fs/tsk_fatxxfs.h

* Home

* Autopsy

* Features

* Download

* Training

* Documents

* History

* Licenses

* The Sleuth Kit

* File Systems

* Download

* Documents

* History

* Licenses

* Other Projects

* Hadoop

* mac-robber

* Support

* Blog (www.autopsy.com) * Forum (forum.sleuthkit.org)

* About

OPEN SOURCE DIGITAL FORENSICS Autopsy® is an easy to use, GUI-based program that allows you to efficiently analyze hard drives and smart phones. It has a plug-in architecture that allows you to find add-on modules or develop custom modules in Java or Python. The Sleuth Kit® is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools. These tools are used by thousands of users around the world and have community-based e-mail lists and forums. Commercial training, support, and custom development is available from Basis

Technology .

LATEST NEWS

*

1

May

Autopsy 4.15.0 released Drones, GPX, and more File Discovery.

*

1

May

The Sleuth Kit 4.9.0 released Removed TSK framework, various fixes.

*

24

Jan

Autopsy 4.14.0 released File Discovery, Maps, APFS, and more.

*

24

Jan

The Sleuth Kit 4.8.0 released APFS, removed JavaFX dependency, misc fixes.

*

14

Oct

Autopsy 4.13.0 released More modules, timeline, and Android.

*

14

Oct

The Sleuth Kit 4.7.0 released New timeline schema and logical imager updates.

*

2

Aug

Autopsy 4.12.0 released Communications, paging, and logical imager.

*

2

Aug

The Sleuth Kit 4.6.7 released Logical imager and other Java fixes.

(Merchandise!)

� 2003-2020 Brian Carrier