OSForensics vs The Sleuth Kit
OSForensics
osforensics.comThe Sleuth Kit
sleuthkit.orgSide by side
| Figure | OSForensics | The Sleuth Kit |
|---|---|---|
| Price from | $78.75/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| Android | Yes | — |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 7 | 1 |
| Spec score · Computer Forensics Software | 8.2 (#3) | 7.5 (#9) |
| Spec score · Digital Forensics Software | 8.1 (#10) | 7.6 (#16) |
| Purpose | OSForensics is digital investigation software for extracting forensic data from computers. | The Sleuth Kit is a C library and command-line tools for investigating disk images and analyzing volume and file system data. |
| Support | Purchases include business-hours support by phone, email or online forums; the trial edition includes free public forum support. | The projects are maintained by volunteers, with user forums and email lists for community help and commercial support available from Sleuth Kit Labs. |
Plans
OSForensics
- OSForensics FreeFree
- OSForensics Trial EditionFree
- OSForensics Subscription$95 a month
- OSForensics Subscription$945 a year
- OSForensics Perpetual License (12 months support)$1,680, paid once
- OSForensics Perpetual License (36 months support)$3,675, paid once
- OSForensics Site LicensePriced on request
In their own words
OSForensics
OSForensics is digital investigation software for extracting and examining forensic data from computers. It searches and indexes files, looks inside documents and email archives, and attempts to recover deleted files. Hashing can verify evidence or compare it with known files, while extension checks can flag files whose extensions are incorrect. The software can surface recent activity such as opened documents, web history, connected USB devices, and network shares. Password tools target commonly used web browsers and can use rainbow tables to retrieve passwords from hashes. Investigators can group evidence into case files, cryptographically hash data, and export reports readable as HTML or PDF, with narratives and external reports. It can maintain a secure audit trail and create or restore disk images for analysis. OSForensics can also run from a portable USB drive. Listed evidence sources include Windows, Mac, Linux, Android, and iOS/macOS file systems, plus disk images, memory dumps, email, browser data, registry hives, SQLite, and ESE databases. Windows 7, 8, 10, and 11 are listed, as are several Windows Server versions. A free license and a 30-day trial are listed; subscription pricing is $95 per user per month.
The Sleuth Kit
The Sleuth Kit is a free, open-source C library and collection of command-line tools for investigating disk images and analysing volume and file-system data. Its tools can list allocated and deleted file names, inspect NTFS attributes, display metadata, and create file-activity timelines. They examine file systems without relying on the host operating system, allowing deleted and hidden content to be shown. Supported images include raw/dd, E01, VHD, VMDK, and AFF. Listed file systems include NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2. Hashes can be checked against NIST NSRL, Hash Keeper, and custom databases. The C library can be embedded in larger forensic tools and powers Autopsy and other forensic products. Listed platforms include Linux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, and Solaris. Volunteers maintain the project, with forums and email lists for community help; commercial support is available from Sleuth Kit Labs. Version 4.14.0 is dated April 15, 2025.