The Sleuth Kit (TSK)
The Sleuth Kit or TSK is a collection of open source digital forensic tools developed by Brian Carrier and Wieste Venema. TSK can read and parse different types of filesystems, such as FAT, NTFS, and EXT. Each area of the hard drive in the figure in the Hard drive structure section has a set of tools in The Sleuth Kit that parses that area and extracts forensically important information for the investigator. Usually, each step leads to the next while using TSK in analysis.
In the upcoming sections, we will go through the different tool sets of The Sleuth Kit. We will use an image of the hard drive with Windows 7 installed, which shows the results from each part in the hard drive. The image was acquired using the FTK Imager lite from a Windows 7 virtual machine with a size of only 15 GB and a single NTFS partition.
As we will see, TSK tool names are easy to understand as they consist of two parts. The first part represents the area or the layer under investigation, such...
