The Sleuth Kit
The Sleuth Kit: A free, developer-friendly toolkit for core disk and filesystem forensics. Ranked #19 of 30 in Digital Forensics Software by our editors (7.4/10); pricing: Open source; best for developers and analysts needing core filesystem analysis.
At a glance
- Editor score7.4 / 10
- PricingOpen source
- Best forDevelopers and analysts needing core filesystem analysis
- Paid fromFree
- Mobile forensicsYes
- Facts checked20 Sep 2026
Where it wins
- Free open-source toolkit across Windows, macOS, and Linux
- Analyzes partitions, metadata, deleted content, timelines, and hashes
- C and C++ APIs support integration into larger forensic applications
Where it doesn't
- Command-line and library toolkit rather than a full case platform
- No dedicated device-acquisition capability
- Requires a separate forensic interface for a guided workflow
Our verdict on The Sleuth Kit
The Sleuth Kit is an open-source C library and collection of command-line digital forensics tools for analyzing disk and file-system images. It is suited to developers and analysts who need core filesystem analysis across Windows, macOS, and Linux, including partition and volume inspection, metadata review, deleted and hidden content examination, timeline generation, file categorization, and hash generation or database lookup. Live-system incident-response operation is also included. Supported evidence sources include Raw/dd, E01/EnCase, VHD, VMDK, and AFF images, with filesystem support spanning NTFS, FAT, ExFAT, APFS, UFS 1/2, EXT2/3/4, HFS, ISO 9660, and YAFFS2.
Its strongest fit is as an analysis foundation that can be incorporated into other software. C and C++ APIs allow developers to integrate disk-image analysis into larger forensic applications, while Autopsy provides a related forensic interface. The toolkit covers a broad range of disk, volume, filesystem, deleted-content, timeline, and hash tasks, making it useful when teams want low-level capabilities rather than a single packaged workflow. Its support for multiple operating systems also suits cross-platform forensic environments.
The trade-off is scope: The Sleuth Kit is a command-line and library toolkit, not a full case-management application. That makes it a practical choice for technically capable users building workflows or working directly with forensic artifacts, but less suitable for teams seeking an end-to-end case platform. Mobile-forensics support is tied to documented YAFFS2 filesystem support, and the toolkit does not provide dedicated device acquisition. Choose it for programmable core analysis and broad filesystem coverage; choose a fuller forensic platform when case management and guided acquisition are central requirements.
Questions about The Sleuth Kit
What does The Sleuth Kit run on? Windows, macOS and Linux. It runs self-hosted.
What does The Sleuth Kit integrate with? 1 integration: Autopsy.
Who is The Sleuth Kit built for? Small businesses, mid-market companies and enterprises (our editorial estimate).
Your product? Our editors can test The Sleuth Kit in depth and publish a review, labelled as paid · from $149/mo →
The Sleuth Kit pricing
The Sleuth Kit fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Free |
| Evidence sources | Raw/dd, E01/EnCase, VHD, VMDK, AFF images; NTFS, FAT, ExFAT, APFS, UFS 1/2, EXT2/3/4, HFS, ISO 9660, and YAFFS2 file systems |
| Mobile forensics | Yes |
| Disk imaging | Yes |
| Memory forensics | Not verified |
| Case collaboration | Not verified |
| Supported platforms | Linux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, Solaris |
| Export formats | Not verified |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 1 integrations: Autopsy |
| Pricing | Open source |
| Website | sleuthkit.org |
| Facts checked | 20 Sep 2026 |
The Sleuth Kit integrations
The Sleuth Kit lists 1 integrations on its own site.
- Autopsy
Alternatives to The Sleuth Kit
- AutopsyA free, cross-platform platform for broad, case-based digital investigations.9.4
- Paraben E3 Forensic PlatformA broad evidence-processing platform for teams handling varied digital investigations.9.3
- Magnet AXIOM CyberA broad investigation platform for collecting and analyzing endpoint, mobile, cloud, and memory evidence.9.2
See all The Sleuth Kit alternatives →
Also Ranked In
The Sleuth Kit is ranked in 2 of our directories.
Used The Sleuth Kit? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used The Sleuth Kit for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
The Sleuth Kit is listed in our Digital Forensics Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/the-sleuth-kit/"><img src="https://www.itechguides.com/best/badge/the-sleuth-kit.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update