Scribd Logo
Upload

Welcome to Scribd!

  • The Sleuth Kit Part 1 - Overview

    Uploaded by

    Nicasio Aquino
    238 views2 pages
    The Sleuth Kit (TSK) is a collection of command line tools and a C library for forensic investigation and data recovery. It allows analysts to perform tasks like file system analysis, file carving, metadata extraction, and timeline creation. TSK includes tools like fsstat, ffind, fls, and icat that allow investigation of file systems and files, as well as tools like mmstat and imgstat that analyze media management structures and image files. The name references a detective or investigator ("sleuth"), and the official logo is a bloodhound to represent TSK's ability to thoroughly investigate digital evidence like a skilled canine tracker.

    Original Description:

    Computer Forensics

    Original Title

    The Sleuth Kit Part 1 – Overview

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The Sleuth Kit (TSK) is a collection of command line tools and a C library for forensic investigation and data recovery. It allows analysts to perform tasks like file system analysis, file carving, metadata extraction, and timeline creation. TSK includes tools like fsstat, ffind, fls, and icat that allow investigation of file systems and files, as well as tools like mmstat and imgstat that analyze media management structures and image files. The name references a detective or investigator ("sleuth"), and the official logo is a bloodhound to represent TSK's ability to thoroughly investigate digital evidence like a skilled canine tracker.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as docx, pdf, or txt
    238 views2 pages

    The Sleuth Kit Part 1 - Overview

    Uploaded by

    Nicasio Aquino
    The Sleuth Kit (TSK) is a collection of command line tools and a C library for forensic investigation and data recovery. It allows analysts to perform tasks like file system analysis, file carving, metadata extraction, and timeline creation. TSK includes tools like fsstat, ffind, fls, and icat that allow investigation of file systems and files, as well as tools like mmstat and imgstat that analyze media management structures and image files. The name references a detective or investigator ("sleuth"), and the official logo is a bloodhound to represent TSK's ability to thoroughly investigate digital evidence like a skilled canine tracker.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as docx, pdf, or txt
    of 2

    The Sleuth Kit Part 1 Overview

    http://sysforensics.org/2012/02/the-sleuth-kit-part-1-overview/

    In this series I am going to touch a bit on how to use The Sleuth Kit (TSK) for digital forensic
    purposes.

    First things first....

    Definition of Sleuth

    According to dictionary.com Sleuth is, "a detective". Some of the synonyms they provide are:
    investigator, private investigator, and i'm going to add, "forensicator".

    The official logo of The Sleuth Kit is a bloodhound. If you know anything about bloodhounds
    you know they are wicked good at tracking humans (dead or alive). They were actually bred for
    this purpose and they have amazing nose capabilities.

    Simply put, You are going to be hunted and discovered. Not unlike a skilled analyst using the
    software version.

    Technical definition of The Sleuth Kit

    According to the Sleuth Kit website, "The Sleuth Kit (TSK) is a C library and a collection of
    command line tools. Autopsy is a graphical interface to TSK. TSK can be integrated into
    automated forensics systems in many ways, including as a C library and by using the SQLite
    database that it can can create. The Sleuth Kit Hadoop Framework is a framework that
    incorporates TSK into cloud computing for large scale data analysis."Patrick Olsen's definition
    is, "A command line based forensic tools suite, which has the power to do much more when
    combined with other tools/technologies". I like simple.
    So now we have some frame of mind as to where these tools came from and how they relate to
    digital forensics. We also have a bit of history of which I will assume was used to name the over
    all project.

    The Sleuth Kit (TSK) tool makeup

    fsstat, ffind, fls, icat, ifind, ils, istat, blkcat, blkls, blkstat, blkcalc, mmls, mmstat, mmcat,
    imgstat, imgcat, disksreset, diskstat, tskcomparedir, tskgettimes, tskloaddb, tskrecover, mactime,
    hfind, sorter, and sigfind.
    The Sleuth Kit Part 1 Overview
    http://sysforensics.org/2012/02/the-sleuth-kit-part-1-overview/
    f/ff: file system and files disk: disk i: metadata structures mm: media management
    (partitions) tsk: fully automated tools blk: process data unitsimg: image file format hfind: hash
    find mactime: time sorter: sorts filessigfind: finds a signature

    Here is a better overview of the tools and what specifically they are used for. I couldn't say it
    better myself so i'll leave it to the creator to provide you the tool-by-tool overview.

    So there you have it. That's a quick overview of what TSK is and what TSK contains. In Part II
    we will start drilling down and I will get into how to use these different tools to perform analysis
    on an image/disk.

    You might also like