The Sleuth Kit is an open source forensic toolkit for analyzing Microsoft and UNIX file systems and disks. The Sleuth Kit enables investigators to identify and recover evidence from images acquired during incident response or from live systems.

The Sleuth Kit® is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools. These tools are used by thousands of users around the world and have community-based e-mail lists and forums.

2014年1月13日 · This page provides an overview of the command line tools in TSK. The TSK tools are organized into layers and this page is organized based on those layers. In general, the following tools take a disk or file system image as input.

2017年10月24日 · The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digi...

2024年1月11日 · Therefore, a novel trustworthy semantic keypoint (TSK) detector is proposed for RSIs. It utilizes a lightweight multiscale feature extraction and fusion network, along with a saliency keypoint localization mechanism, to facilitate keypoint detection.

2017年10月24日 · icat outputs the contents of a file in a disk image to STDOUT. It is similar to cat on a local file, but it takes a meta data structure address as input instead of a file name. The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data.

tsk_img_open (int, const TSK_TCHAR *const images[], TSK_IMG_TYPE_ENUM, unsigned int a_ssize) Opens one or more disk image files so that they can be read. More...

Currently, TSK supports several filesystems, as NTFS, FAT, exFAT, HFS+, Ext3, Ext4, UFS and YAFFS2. This package contains the Java Bindings. The Sleuth Kit, also known as TSK, is a collection of UNIX-based command line file and volume system forensic analysis tools.

2021年1月26日 · 将文件从映像导出到本地目录中。 tsk_recover将文件从映像恢复到output_dir。 默认情况下，仅恢复未分配的文件。 带有标志，它将导出所有文件。 参数如下： 详细输出到stderr. 打印版本信息. 仅恢复已分配文件. 恢复所有文件(已分配和未分配) 指定文件系统类型。 使用“ -f列表”列出支持的文件系统类型。 如果未给出，则使用自动检测方法。 图像文件的格式，例如raw。 使用“ -i列表”列出支持的类型。 如果未给出，则使用自动检测方法。 设备扇区的大小( …

The Framework is a command line interface that uses different modules to analyze disk images. The framework contains two applications: tsk_analyzeimg and tsk_validatepipeline, which are both located in the bin folder. tsk_analyzeimg is the main executable that uses a variety of modules for file analysis.