Skip to content
SPECIFICTION
Get listed

The Sleuth Kit

sleuthkit.org

Free plan WindowsmacOSLinuxAPISelf-hosted
Visit sleuthkit.org
Spec score 7.5 #9 of 23 in Computer Forensics Software

What it is

The Sleuth Kit is a free, open-source C library and collection of command-line tools for investigating disk images and analysing volume and file-system data. Its tools can list allocated and deleted file names, inspect NTFS attributes, display metadata, and create file-activity timelines. They examine file systems without relying on the host operating system, allowing deleted and hidden content to be shown. Supported images include raw/dd, E01, VHD, VMDK, and AFF. Listed file systems include NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2. Hashes can be checked against NIST NSRL, Hash Keeper, and custom databases. The C library can be embedded in larger forensic tools and powers Autopsy and other forensic products. Listed platforms include Linux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, and Solaris. Volunteers maintain the project, with forums and email lists for community help; commercial support is available from Sleuth Kit Labs. Version 4.14.0 is dated April 15, 2025.

Spec sheet

Purpose
The Sleuth Kit is a C library and command-line tools for investigating disk images and analyzing volume and file system data.Read 9 Oct 2026 · sleuthkit.org
Integrations
The C library can be incorporated into larger digital forensics tools, and The Sleuth Kit powers Autopsy and other open source and commercial forensic tools.Read 9 Oct 2026 · sleuthkit.org
Support
The projects are maintained by volunteers, with user forums and email lists for community help and commercial support available from Sleuth Kit Labs.Read 9 Oct 2026 · sleuthkit.org
License
Source files use several licenses; the core code is under the IBM Public License or Common Public License, and other utilities are not GPL or copyleft, with a standalone GNU strings copy under GPL 2.Read 9 Oct 2026 · sleuthkit.org
Analysis features
The tools can list allocated and deleted file names, inspect NTFS attributes, show file system metadata, and create file activity timelines.Read 9 Oct 2026 · sleuthkit.org
Development
Users can report bugs through the project bug tracker and submit code contributions under the developer guidelines.Read 9 Oct 2026 · sleuthkit.org
Disk formats
It analyzes raw, E01, VHD, VMDK, and AFF file system and disk images.Read 9 Oct 2026 · sleuthkit.org
Download
The download page lists version 4.14.0 dated April 15, 2025, with source code and Windows binaries.Read 9 Oct 2026 · sleuthkit.org
File recovery
Its file system tools examine file systems without relying on the host operating system to process them, allowing deleted and hidden content to be shown.Read 9 Oct 2026 · sleuthkit.org
File systems
Listed file system support includes NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2.Read 9 Oct 2026 · sleuthkit.org
Hash lookup
The toolkit can look up file hashes in databases including NIST NSRL, Hash Keeper, and custom databases.Read 9 Oct 2026 · sleuthkit.org
Security note
The description says the live Windows or UNIX tools can show files hidden by rootkits and do not modify the access time of files viewed.Read 9 Oct 2026 · sleuthkit.org
Supported systems
The site says it runs on Windows and Unix platforms and lists testing on Linux, Mac OS X, Windows, Cygwin, Open and FreeBSD, and Solaris.Read 9 Oct 2026 · sleuthkit.org

Plans and prices

The Sleuth Kit Free Open source forensic tools and C library Read 9 Oct 2026 · sleuthkit.org

Every The Sleuth Kit plan and price →

Strong points and limits

Strong points

  • Free open-source forensic toolkit
  • Shows deleted and hidden content
  • Supports multiple disk-image formats
  • Builds file-activity timelines
  • C library supports integrations

Limits

  • Command-line tools require technical use
  • Source files use several different licenses
  • Community maintenance is volunteer-led
  • Commercial support is separate

Who it suits

It suits forensic investigators and developers building tools for disk-image, volume, and file-system analysis. Its command-line utilities, C library, broad image formats, and multi-platform support fit technical workflows.

Verdict

The Sleuth Kit provides low-level forensic analysis through command-line tools and a reusable C library. Its broad image and file-system support, hash databases, and integrations make it suitable for building or operating digital-forensics workflows.

Where Specifiction places it

Alternatives to The Sleuth KitAll alternatives →