Belkasoft X Forensic vs The Sleuth Kit
Belkasoft X Forensic
belkasoft.comThe Sleuth Kit
sleuthkit.orgSide by side
| Figure | Belkasoft X Forensic | The Sleuth Kit |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Computer Forensics Software | 8.2 (#2) | 7.5 (#9) |
| Spec score · Digital Forensics Software | 8.2 (#7) | 7.6 (#16) |
| License | Belkasoft describes the license as perpetual, with optional annual software maintenance and support. | Source files use several licenses; the core code is under the IBM Public License or Common Public License, and other utilities are not GPL or copyleft, with a standalone GNU strings copy under GPL 2. |
| Purpose | Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources. | The Sleuth Kit is a C library and command-line tools for investigating disk images and analyzing volume and file system data. |
| Support | Belkasoft lists [email protected] as its support contact. | The projects are maintained by volunteers, with user forums and email lists for community help and commercial support available from Sleuth Kit Labs. |
Plans
In their own words
Belkasoft X Forensic
Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources. Its acquisition options include DD/E01 imaging, iOS checkm8 and agent-based acquisition, and several Android methods. Analysis features include timeline and connection graph views, SQLite recovery, hash-set analysis, file carving, and picture and video analysis. The software can examine UFED and GrayKey images, virtual machines, Amazon S3-based images, Berla car exports, and data from services including Google Drive, iCloud, Microsoft 365, WhatsApp, and Telegram. Reports can be produced in formats such as HTML, XML, CSV, PDF, Excel, Word, ProjectVIC JSON, and Relativity Short Message Format. Colleagues can view shared findings with the free Evidence Reader, whether or not X Forensic is installed. The product is self-hosted and offered to government customers only. Its license is perpetual, with optional annual software maintenance and support; pricing is provided by quote. A 30-day trial requires internet access. Trial reports contain half of randomly selected artifacts, and several acquisition, decryption, virtual-machine, and command-line automation features are excluded. The company describes it as suited to digital forensic laboratories at federal and state-level law-enforcement agencies.
The Sleuth Kit
The Sleuth Kit is a free, open-source C library and collection of command-line tools for investigating disk images and analysing volume and file-system data. Its tools can list allocated and deleted file names, inspect NTFS attributes, display metadata, and create file-activity timelines. They examine file systems without relying on the host operating system, allowing deleted and hidden content to be shown. Supported images include raw/dd, E01, VHD, VMDK, and AFF. Listed file systems include NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2. Hashes can be checked against NIST NSRL, Hash Keeper, and custom databases. The C library can be embedded in larger forensic tools and powers Autopsy and other forensic products. Listed platforms include Linux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, and Solaris. Volunteers maintain the project, with forums and email lists for community help; commercial support is available from Sleuth Kit Labs. Version 4.14.0 is dated April 15, 2025.