The Sleuth Kit

The Sleuth Kit is a free C library and command-line toolkit for examining disk images and file-system data. It is best suited to forensic practitioners and developers who need low-level analysis or components for a larger tool. Its breadth of evidence support is a strong reason to choose it; teams wanting a ready-made graphical workflow should look elsewhere.

Overview

The tools examine file systems independently of the host operating system, allowing investigators to surface deleted and hidden content. They can also inspect live Windows and UNIX systems, including files hidden by rootkits, without changing the access time of viewed files. That makes The Sleuth Kit useful for targeted examination, but its command-line and library focus calls for a technical workflow.

The C library can be incorporated into other digital-forensics software, and The Sleuth Kit powers Autopsy along with other open-source and commercial tools. It is therefore both a usable toolkit and a foundation for teams building forensic applications. Users who want a packaged, guided experience may find it less direct.

Key features

• Image and file-system coverage: It analyzes raw, E01, VHD, VMDK, and AFF images. Supported file systems include NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2. This range is valuable when an investigation spans different operating systems and storage formats.
• Deleted-file and metadata examination: The tools can list allocated and deleted file names, inspect NTFS attributes, and show file-system metadata. These functions help investigators move from a broad image to specific evidence, though they are analysis primitives rather than a complete case-management workflow.
• Timeline and hash analysis: Users can create file-activity timelines and look up hashes in databases such as NIST NSRL, Hash Keeper, and custom collections. That supports time-based review and known-file identification without narrowing investigators to one database.
• Mobile and disk evidence: The toolkit supports mobile forensics and disk imaging, extending its use beyond file-system examination alone.
• Library integration: The C library lets developers embed its functionality in larger forensic tools. This is a meaningful advantage for product builders, but less important to investigators seeking a standalone graphical suite.

Pricing

The Sleuth Kit costs free and is open source. The free offering includes the forensic tools and C library; there are no paid tiers or usage caps described. That makes it suitable for individual practitioners, labs, and developers who can work with the command line or integrate the library.

The source files use several licenses. Core code is under the IBM Public License or Common Public License; other utilities are not GPL or copyleft, while a standalone GNU strings copy is under GPL 2. Review the license of each relevant source file before incorporating it into another project.

Platforms

The Sleuth Kit runs on Windows and Unix platforms, with support and testing spanning Linux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, and Solaris. The download page lists source code and Windows binaries for version 4.14.0, dated April 15, 2025. Its cross-platform reach is useful for mixed environments, although platform breadth does not change the toolkit's technical orientation.

Who it's for

Choose The Sleuth Kit if you need to inspect disk images and file systems directly, recover visibility into deleted or hidden content, or build forensic capabilities into another application. It suits technically equipped investigators and developers who value broad format support and control over their workflow. It is a weaker fit for users who need a turnkey interface or guided investigation process.

Volunteer maintainers support the project through user forums and email lists, with commercial support available from Sleuth Kit Labs. Users can report bugs through the project tracker and contribute code under the developer guidelines. This gives organizations community and commercial support paths, but does not make the project a managed service.

Pros and cons

Pros

• Broad evidence coverage: Support for multiple disk-image formats and file systems suits varied investigations.
• Useful low-level analysis: Deleted-name listings, NTFS attribute inspection, metadata, timelines, and hash lookup cover core examination tasks.
• Extensible C library: Developers can build its capabilities into larger tools instead of treating it only as a standalone utility.
• Free and open source: The tools and library are available at no charge, with no stated usage limits.

Cons

• Technical workflow: Command-line tools and a C library are less suitable for users seeking a ready-to-use graphical suite.
• License review is necessary: Different source files use different licenses, so developers must check the components they redistribute or incorporate.
• Volunteer-led maintenance: Community help is available, but teams needing commercial support must seek it separately from Sleuth Kit Labs.

Alternatives

Browse digital forensics software to compare other tools for investigative workflows.

• Hayabusa is another free option for Linux, macOS, and Windows; choose it when that platform range and its GNU AGPLv3 licensing, with detection rules under DRL 1.1, better suit your work.
• NetworkMiner has a free edition and is written in managed C# on the Microsoft .NET Framework under GPLv2; consider it when that implementation and license fit your environment.
• OSForensics offers a free license and a 30-day trial edition, with feature differences; choose it if those edition options and its Windows-focused platform support suit your needs.
• Plaso is free across Linux, macOS, Windows, and self-hosted environments, with no commercial plan or usage limits stated; consider it for that platform range.
• Volatility 3 is a free, open-source framework for Linux, macOS, Windows, and self-hosted use; choose it if that framework and platform set better fit your requirements.
• Arkime is free and open source, with no license fees or paid-only features, and supports API, Linux, self-hosted, and web use; it is an alternative to consider.
• CAINE provides a free Linux and Windows ISO of approximately 4000 MB; third-party software has separate licenses. Consider it if an ISO-based option fits your setup.
• Exterro FTK Imager offers a free Windows-only forensic imaging and preview tool, plus a Pro plan at $499 a year; choose it when that imaging-and-preview focus or paid option is preferable.

Verdict

The Sleuth Kit is a strong choice for investigators and developers who want free, low-level disk-image and file-system analysis with broad format coverage and a reusable C library. Its principal trade-off is the technical workflow, compounded for software builders by the need to check licenses file by file. Choose it when control and integration matter more than a turnkey interface; look elsewhere when guided graphical investigation is the priority.