Sleuth Kit - Open Source Forensic Tool to Analyze Disk Images and Recover Files

SIFT is a Ubuntu based forensics distribution provided by SANS Inc. It consist of many forensics tools such as Sleuth kit / Autopsy etc . However, Sleuth kit/Autopsy tools can be installed on Ubuntu/Fedora distribution  instead of downloading complete distribution of SIFT.

Sleuth Kit /Autopsy is open source digital forensics investigation tool which is used for recovering the lost files from disk image and analysis of images for incident response. Autopsy tool is a web interface of sleuth kit which supports all features of sleuth kit. This tool is available for both  Windows and Linux Platforms.

Install Sleuth kit

First of all, download Sleuth kit software from sleuthkit website. Use wget command to download it in terminal which is shown in the figure.

# wget
Download Sleuth Kit

Extract the sleuthkit-4.1.3.tar.gz  using following command and go inside the extracted directory

# tar -xvzf sleuthkit-4.1.3.tar.gz
Extraction Process

Run following command which perform the requirement check before sleuth kit installation


Make command compile the sleuth kit code.


Finally following command install it under /usr/local path.

#make install
make install

Install Autopsy Tool

Sleuth kit installation is complete and now we will install autopsy interface. Download Autopsy software from sleuthkit's autopsy page . Use wget command to download it in terminal which is shown in the figure.

# wget
Autpsy download link

Extract the autopsy-2.24.tar.gz  using following command and go inside the extracted directory

# tar -xvzf autopsy-2.24.tar.gz
Autopsy Extraction

Configuration script of autopsy asks for NSRL (National Software Reference Library) and path of Evidence_Locker folder.

Enter "n" for NSRL prompt and create Evidence_Locker folder under /usr/local directory. Autopsy stores the configuration files, audit logs and output under Evidence_Locker folder.

#mkdir /usr/local/Evidence_Locker

#cd autopsy-2.24

Autopsy Configuration Script

After adding Evidence_Locker path in installation process , autopsy stores configuration files in it and shows a following message to run the autopsy program.

Start Autopsy

Type ./autopsy command in terminal to start the graphical interface of Sleuth kit tool.

Autopsy Started

Type following address in the web browser to access the interface of autopsy .


Main web page of autopsy plugin is shown int the following figure.

Main Page

Click on the New Case button to start analysis in autopsy tool. Enter the case name, description about the investigation and name of agent which is shown in the following figure.

create new case

Following web page will appear  after entering the details in the above page. Click on Add Host button to add details for the analyst machine.

add host

Enter host name, description and time zone setting of analyst machine on the next page.

add host-detial

Click on the Add Image button to add image file for forensics analysis.

add image

Click on the Add Image File button on the following web page.  It opens new web page which require Path of image file and select  type  & importing method.

Add image file

As shown in the following figure, we have entered path of Linux image file. In our case, image file is  partition of disk.

add image parition

Click on the next button and select Calculate hash option in the next page which is shown in the following figure. It also detect the file system type of the given image.

image and file system detail

Following window shows the MD5 hash of the image file before static analysis .


On the next web page, autopsy shows following information about the image file.

  • mount point for the image
  • name of image
  • file system type of given image

Click on the details button to get more information about the given image file. It also offer extraction of unallocated fragments and strings from the  volume of image file which is shown in the following figure.

Image detail

Click on Analyze button which is shown in the below figure to start analysis on given image  . It opens another page which shows the multiple options for image analysis.


Autopsy offer following features during image analysis process.

  • File Analysis
  • Keyword Search
  • File Type
  • Image Details
  • Data Unit

File Analysis on given  image of Linux partition is shown in the following figure.

Analysis of image

It extracts all files and folders from the given image . Extraction of deleted files are shown int he figure.

Deleted Files


Hopefully this article will be useful for the beginner in static forensics analysis of disk image. Autopsy is web interface for sleuth kit which provides features such as extraction of strings , recovery of deleted files, timeline analysis, extraction of web surfing history, keyword search and email analysis on windows and linux disk images.

1 thought on “Sleuth Kit - Open Source Forensic Tool to Analyze Disk Images and Recover Files”... add one

Leave a Comment