The Sleuth Kit

The Sleuth Kit (previously known as TASK) is a collection of UNIX-based
command line file system and media management forensic analysis tools.
The file system tools allow you to examine file systems of a suspect
computer in a non-intrusive fashion. Because the tools do not rely on
the operating system to process the file systems, deleted and hidden
content is shown.

The media management tools allow you to examine the layout of disks and
other media. The Sleuth Kit supports DOS partitions, BSD partitions
(disk labels), Mac partitions, Sun slices (Volume Table of Contents),
and GPT disks. With these tools, you can identify where partitions are
located and extract them so that they can be analyzed with file system
analysis tools.

When performing a complete analysis of a system, we all know that command
line tools can become tedious. The Autopsy Forensic Browser is a graphical
interface to the tools in The Sleuth Kit, which allows you to more easily
conduct an investigation. Autopsy provides case management, image
integrity, keyword searching, and other automated operations.

Input Data

* Analyzes file system images generated by the 'dd' command, which is
  found on all UNIX systems and is available for Windows systems. This
  is a raw format and not proprietary.

* Supports the NTFS, FAT, FFS, EXT2FS, and EXT3FS file systems even
  when the host operating system does not or has a different endian
  ordering.

* Tools can be run on a live UNIX system during Incident Response. These
  tools will show files that have been "hidden" by rootkits and will not
  modify the A-Time of files that are viewed.

* Partitions of different platforms and endian orderings can be extracted
  and analyzed using the media management tools.

Search Techniques

* List allocated and deleted file names.

* Display the details and contents of all NTFS attributes (including all
  Alternate Data Streams).

* Display file system and meta-data structure details.

* Create timelines of file activity, which can be imported into a spread
  sheet to create graphs and reports. (Sleuth Kit Informer #5)

* Lookup file hashes in a hash database, such as the NIST NSRL, Hash Keeper,
  and custom databases that have been created with the 'md5sum' tool.
  (Sleuth Kit Informer #6, Sleuth Kit Informer #7)

* Organize files based on their type (for example all executables, jpegs,
  and documents are separated). Pages of thumbnails can be made of graphic
  images for quick analysis.  (Sleuth Kit Informer #3, #4, #5)

The Sleuth Kit is written in C and Perl and uses some code and design from The Coroner's Toolkit (TCT). The Sleuth Kit has been tested on:

* Linux
* Mac OS X
* Open & FreeBSD
* Solaris
* CYGWIN

The Sleuth Kit homepage is located at:

	http://sleuthkit.sourceforge.net/sleuthkit/

Cryptographic signatures and checksums may be provided by 
the developers at the URL(s) above.  Wiretapped recommends
that users check these before use of the software/information.