| libtsk-dev | Development files for forensics analysis | Mehr ... |
| libtsk3-3 | Library for forensics analysis | Mehr ... |
| libtsk3-3-dbg | Library for forensics analysis with debug symbols | Mehr ... |
| sleuthkit | Tools for forensics analysis | Mehr ... |
The Sleuth Kit (previously known as TASK) is a collection of UNIX-based
command line file system and media management forensic analysis tools.
The file system tools allow you to examine file systems of a suspect
computer in a non-intrusive fashion. Because the tools do not rely on
the operating system to process the file systems, deleted and hidden
content is shown.
.
The media management tools allow you to examine the layout of disks and
other media. The Sleuth Kit supports DOS partitions, BSD partitions
(disk labels), Mac partitions, and Sun slices (Volume Table of
Contents). With these tools, you can identify where partitions are
located and extract them so that they can be analyzed with file system
analysis tools.
.
When performing a complete analysis of a system, we all know that
command line tools can become tedious. The Autopsy Forensic Browser is
a graphical interface to the tools in The Sleuth Kit, which allows you
to more easily conduct an investigation. Autopsy provides case
management, image integrity, keyword searching, and other automated
operations. |
