125 sleuthkit(1) - Kailash Tool Reference
125.1 sleuthkit
sleuthkit - Library and CLI collection for filesystem forensics analysis.
| Layer | CLASSIC |
| Category | c-09-forensics-ir-reporting |
| Safety class | safe |
| Licence | CPL-1.0 |
| Upstream | github.com/sleuthkit/sleuthkit |
125.1.1 NAME
sleuthkit - Library and CLI collection for filesystem forensics analysis.
125.1.2 SYNOPSIS
Not derived automatically - see upstream documentation. This page does not hand-copy flags (generation contract, ADR-0001).
125.1.3 DESCRIPTION (upstream)
The Sleuth Kit is an open source forensic toolkit for analyzing Microsoft and UNIX file systems and disks. The Sleuth Kit enables investigators to identify and recover evidence from images acquired during incident response or from live systems. The Sleuth Kit is open source, which allows investigators to verify the actions of the tool or customize it to specific needs. The Sleuth Kit uses code from the file system analysis tools of The Coroner’s Toolkit (TCT) by Wietse Venema and Dan Farmer. The TCT code was modified for platform independence. In addition, support was added for the NTFS (see wiki/ntfs) and FAT (see [w
125.1.4 SEE ALSO
- Category: c-09-forensics-ir-reporting in the category directory (sister tools listed there).
ref: pin - verified 2026-10-14