Search Results for "sleuth kit"

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Autopsy was designed to be intuitive out of the box. Installation is easy and wizards guide you through every step.

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.

...It organizes foundational topics such as evidence acquisition, disk and memory analysis, file system structures, network forensics, artifact extraction, timeline generation, and reporting into digestible modules that help build core competency. Alongside conceptual explanations, the guide includes practical examples with widely used tools (like Autopsy, Volatility, Sleuth Kit, and network analysis suites), illustrating how investigations proceed from initial data capture to final analysis. The goal is to provide both a learning path and a quick reference for real-world casework, bridging the gap between academic theory and operational practice.

The Sleuth Kit is a C++ library and collection of open source file system forensics tools that allow you to, among other things, view allocated and deleted data from NTFS, FAT, FFS, EXT2, Ext3, HFS+, and ISO9660 images.

...Investigators can use this tool to selectively retrieve only certain kinds of files (text, images, video, audio, documents, etc.) for a quick overview of information or for recovery using the "icat" Sleuth Kit tool to actually go into the image and select the files of interest to display.

mac-robber is a digital forensics and incident response tool that can be used with The Sleuth Kit to create a timeline of file activity for mounted file systems.

the Revealer Toolkit is a framework and simple scripts for computer forensics. It uses Brian Carrier's The Sleuth Kit as the backbone, as well as other free tools. Additional information: http://code.google.com/p/revealertoolkit

tskmount, is a Fuse filesystem written in perl and based on The Sleuth Kit tools. It is intended to provide an easy way to recover deleted files over ext2, fat and ntfs filesystems.

The Penguin Sleuth Kit is a Bootable CD and a Vmware Virtual Platform.The Penguin Sleuth Kit adapts a great Linux resource to include tools that are useful when performing a forensic computer analysis & Security Auditing. Details: www.linux-forensics.com

sleuthkit-sharp is a .NET wrapper for The Sleuth Kit. It provides classes and methods that covers most much of Sleuth Kit's API. It supports Windows, Mac, and Linux.