About

sleuthkit.org is the official website for The Sleuth Kit, Autopsy Forensic Browser, and other open source digital investigation tools. From here, you can find documents, case studies, and download the latest versions of the software. Tools on this site also have a Source Forge site.

These tools have the following goals:

• Provide as much information as possible. These tools require the user to know what data can be ignored for a given case, but the data are there in case it is needed.
• Open. Everything is an an open format so that users can verify it, learn from it, and not be constrained by it.
• Education.

Mission

To create the leading open source file and volume system forensic analysis tools that run on all major platforms and allow access to common data types in methods that support standard analysis techniques.

History

The Sleuth Kit was previously developed with assistance from @stake and was called The @stake Sleuth Kit (TASK). Development of The Sleuth Kit is now done independently from commercial and academic organizations. TASK was based on The Coroner's Toolkit (TCT) and TCTUTILs and it added support for FAT and NTFS file systems.

Autopsy was originally developed as a graphical interface to TCT and TCTUTILs in March 2001. It has been constantly updated to reflect the advancements in The Sleuth Kit and TASK.

A more detailed history and high-level design can be found in Issue #1 of the Sleuth Kit Informer.

Development

Brian Carrier has developed most of the code in The Sleuth Kit, Autopsy, mac-robber, and TCTUTILs. Dan Farmer and Wietse Venema developed The Coroner's Toolkit, from which these tools were based on. Credit for all patches and debugging help from users are noted in the CHANGES file in each distribution.

Samir Kapuria helped with the new interface design of Autopsy 1.70.

Support

The following companies have supported the development of The Sleuth Kit.