EVERYTHING XIAOMI
Get listed

The Sleuth Kit

The Sleuth Kit is an open-source C library and collection of command-line tools for examining disk images, volumes, and file-system data.

Place
#7 of 23
Score
6.2
The Sleuth Kit's website

What The Sleuth Kit is

The Sleuth Kit is an open-source C library and collection of command-line tools for examining disk images, volumes, and file-system data. Its tools can list allocated and deleted file names, inspect NTFS attributes, display file-system metadata, and create file-activity timelines. They examine file systems without relying on the host operating system to process them, allowing deleted and hidden content to be shown. Supported image formats include raw, E01, VHD, VMDK, and AFF. Listed file systems include NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2. The toolkit can compare file hashes with NIST NSRL, Hash Keeper, and custom databases. Its C library can be incorporated into larger forensic tools, and it powers Autopsy and other open-source and commercial tools. Listed platforms include Linux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, and Solaris. The software is free; source files use several licenses. Volunteer maintainers offer community forums and email lists, while commercial support is available from Sleuth Kit Labs.

Good

  • Lists support for raw, E01, VHD, VMDK, and AFF images
  • Can reveal deleted and hidden content
  • Creates file-activity timelines
  • Hash lookups include custom databases
  • C library can integrate with other tools

Watch out

  • Command-line tools rather than a graphical interface
  • Source files use several licenses
  • Community support is volunteer-maintained

Who it suits

The Sleuth Kit suits forensic practitioners and developers who need command-line disk and file-system analysis or a library for larger tools. Its broad listed image and file-system support may help when investigating varied evidence sources.

Verdict

The Sleuth Kit provides a broad set of disk-image and file-system analysis tools, with an integration path through its C library. Review the license details for the specific source files you plan to use.

Plans and prices

From The Sleuth Kit's own pricing page, checked 9 Oct 2026.

All about pricing
PlanPriceWhat it gives you
The Sleuth KitFreeOpen source forensic tools and C library

The facts

Each one read from The Sleuth Kit's own pages, with the date it was checked.

What it does

Analysis features
The tools can list allocated and deleted file names, inspect NTFS attributes, show file system metadata, and create file activity timelines.checked 9 Oct 2026
Development
Users can report bugs through the project bug tracker and submit code contributions under the developer guidelines.checked 9 Oct 2026
Disk formats
It analyzes raw, E01, VHD, VMDK, and AFF file system and disk images.checked 9 Oct 2026
Download
The download page lists version 4.14.0 dated April 15, 2025, with source code and Windows binaries.checked 9 Oct 2026
File recovery
Its file system tools examine file systems without relying on the host operating system to process them, allowing deleted and hidden content to be shown.checked 9 Oct 2026
File systems
Listed file system support includes NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2.checked 9 Oct 2026
Hash lookup
The toolkit can look up file hashes in databases including NIST NSRL, Hash Keeper, and custom databases.checked 9 Oct 2026
Integrations
The C library can be incorporated into larger digital forensics tools, and The Sleuth Kit powers Autopsy and other open source and commercial forensic tools.checked 9 Oct 2026
License
Source files use several licenses; the core code is under the IBM Public License or Common Public License, and other utilities are not GPL or copyleft, with a standalone GNU strings copy under GPL 2.checked 9 Oct 2026
Purpose
The Sleuth Kit is a C library and command-line tools for investigating disk images and analyzing volume and file system data.checked 9 Oct 2026
Security note
The description says the live Windows or UNIX tools can show files hidden by rootkits and do not modify the access time of files viewed.checked 9 Oct 2026
Support
The projects are maintained by volunteers, with user forums and email lists for community help and commercial support available from Sleuth Kit Labs.checked 9 Oct 2026
Supported systems
The site says it runs on Windows and Unix platforms and lists testing on Linux, Mac OS X, Windows, Cygwin, Open and FreeBSD, and Solaris.checked 9 Oct 2026

Alternatives to The Sleuth Kit

All alternatives
  1. 1Paraben E3 Forensic Platform logo

    Paraben E3 Forensic Platform

    AndroidiOSLinuxmacOS
    7.1From $699 a year
    Visit
  2. 2OSForensics logo

    OSForensics

    Free planAndroidSelf-hostedWindows
    7.0From $945 a year
    Visit
  3. 3

    Belkasoft X Forensic

    AndroidiOSLinuxmacOS
    6.5
    Visit
  4. 4

    MOBILedit Forensic

    Windows
    6.4€99 one-time
    Visit
  5. 5

    Cellebrite Inseyets

    WebWindows
    6.2
    Visit
  6. 6

    SIFT Workstation

    Free planLinuxSelf-hostedWindows
    6.2Free plan
    Visit