Oxygen Forensic Detective vs The Sleuth Kit
Oxygen Forensic Detective
oxygenforensics.comThe Sleuth Kit
sleuthkit.orgSide by side
| Figure | Oxygen Forensic Detective | The Sleuth Kit |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Computer Forensics Software | 7.3 (#11) | 7.5 (#9) |
| Spec score · Digital Forensics Software | 7.3 (#21) | 7.6 (#16) |
| Integrations | The product page lists Project VIC integration, and version 18.3.1 notes support for importing GrayKey extraction data. | The C library can be incorporated into larger digital forensics tools, and The Sleuth Kit powers Autopsy and other open source and commercial forensic tools. |
| Purpose | Oxygen Forensic® Detective extracts, decodes, and analyzes digital evidence from multiple sources for forensic investigations. | The Sleuth Kit is a C library and command-line tools for investigating disk images and analyzing volume and file system data. |
| Support | The getting-started guide says customers can use their customer area to download software and supporting files, request the latest keycode, or contact support. | The projects are maintained by volunteers, with user forums and email lists for community help and commercial support available from Sleuth Kit Labs. |
Plans
Oxygen Forensic Detective
- Oxygen Forensic® DetectivePriced on request
In their own words
Oxygen Forensic Detective
Oxygen Forensic Detective has no write-up on Specifiction yet; its figures are above.
The Sleuth Kit
The Sleuth Kit is a free, open-source C library and collection of command-line tools for investigating disk images and analysing volume and file-system data. Its tools can list allocated and deleted file names, inspect NTFS attributes, display metadata, and create file-activity timelines. They examine file systems without relying on the host operating system, allowing deleted and hidden content to be shown. Supported images include raw/dd, E01, VHD, VMDK, and AFF. Listed file systems include NTFS, FAT, ExFAT, APFS, UFS, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2. Hashes can be checked against NIST NSRL, Hash Keeper, and custom databases. The C library can be embedded in larger forensic tools and powers Autopsy and other forensic products. Listed platforms include Linux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, and Solaris. Volunteers maintain the project, with forums and email lists for community help; commercial support is available from Sleuth Kit Labs. Version 4.14.0 is dated April 15, 2025.