sleuthkit.org is the official website for The Sleuth Kit®, Autopsy®, and other open source digital investigation tools. From here, you can find documents, case studies, and download the latest versions of the software.

These tools have the following goals:

  • Provide as much information as possible. These tools require the user to know what data can be ignored for a given case, but the data are there in case it is needed.
  • Open. Everything is an an open format so that users can verify it, learn from it, and not be constrained by it.
  • Education.


To create the leading open source file and volume system forensic analysis tools that run on all major platforms and allow access to common data types in methods that support standard analysis techniques.


The Sleuth Kit was previously developed with assistance from @stake and was called The @stake Sleuth Kit (TASK). TASK was based on The Coroner's Toolkit (TCT) and TCTUTILs and it added support for FAT and NTFS file systems.

Autopsy was originally developed as a graphical interface to TCT and TCTUTILs in March 2001. It has been constantly updated to reflect the advancements in The Sleuth Kit. Version 3 was a complete rewrite and largely funded by Basis Technology (now Sleuth Kit Labs).


Brian Carrier has developed most of the code in The Sleuth Kit, Autopsy 1 and 2, mac-robber, and TCTUTILs. Basis Technology has been building Autopsy since veresion 3. Dan Farmer and Wietse Venema developed The Coroner's Toolkit, from which these tools were based on. Credit for all patches and debugging help from users are noted in the CHANGES file in each distribution.

Samir Kapuria helped with the new interface design of Autopsy 1.70.


The following companies have supported the development of The Sleuth Kit.