Upstream describes command-line analysis of disk images and supported Microsoft and UNIX filesystems. Record the image format, filesystem, tool release, and feature used; support is not identical for every filesystem.
Which filesystem record supports the recovered name or content?
A filesystem entry, its allocation state, and content recovered by address are different observations. A recovered name can help locate an object without proving who created or opened it. Carved content may lack the name and timestamps available in a filesystem-based extraction.
Preserve a reproducible analysis
Preserve the complete source image or segment set and its acquisition record. Record the partition offset and object identifier used in extraction, together with errors and any extraction hash. A report should let another examiner relocate the same record rather than relying on a screenshot.
A useful validation question
Use a known image containing allocated, deleted, fragmented, and unsupported items relevant to the question. Compare raw structures or a suitably independent parser. If two tools disagree, preserve both outputs and locate the field producing the disagreement.
Project and applicability record
- Purpose
- Filesystem and image analysis
- Input
- Supported disk images and filesystem structures
- Analysis platform
- Cross-platform; verify requirements for the selected release and feature.
- License / cost
- Multiple component notices; the API did not identify one SPDX license. Inspect upstream license files for the components you use. Upstream source and license files
- Maintenance observation
- Repository not archived; recorded upstream push 2026-10-20T00:48:59Z. Activity does not guarantee support.
- Exact version tested here
- None. Documentation and repository metadata checks only.
Original sources and next steps
- Official The Sleuth Kit documentation
Producer documentation; select the release relevant to your analysis.
- sleuthkit/sleuthkit
Original upstream source repository.
- Release history and changes
Upstream release availability is separate from local validation.
- Plan a bounded validation study
Check the feature and input format that support the conclusion.
- Verify the input and derivatives
Keep analysis outputs traceable to preserved sources.