The Sleuth Kit (TSK) is a collection of command-line tools that read disk images at the volume and filesystem level without mounting them. Because it works on images and never touches the live filesystem, it's the safe, defensible foundation of Linux forensic analysis — and it's the engine underneath the Autopsy GUI.
# Debian / Ubuntu
apt install sleuthkit
# Fedora / RHEL
dnf install sleuthkit
# Arch
pacman -S sleuthkit
# verify
fls -VA whole-disk image has a partition table; the filesystem lives inside a partition. The volume tools separate the two:
# show the partition table of a raw image
mmls /evidence/image.dd
# output - note the START sector of each partition
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
000: Meta 0000000000 0000000000 0000000001 Primary table (#0)
001: ------- 0000000000 0000002047 0000002048 Unallocated
002: 000:000 0000002048 0000208895 0000206848 Linux (0x83)
003: 000:001 0000208896 0000250879 0000041984 Linux swap (0x82)
# extract partition 2 (Start 2048) as its own image
mmcat /evidence/image.dd 2 > /evidence/part2.dd
# now work on part2.dd with the filesystem tools# filesystem type, block size, superblock info
fsstat -f ext4 /evidence/part2.dd
# list the root directory (d = dir, r = regular, * = deleted)
fls -f ext4 /evidence/part2.dd /
d/d 141000: home
d/d 141001: var
r/r 141002: secret_plan.pdf
r/r * 141003: deleted_note.txt <- deleted!
# recursive listing of a subtree
fls -r -f ext4 /evidence/part2.dd /home/bob
# inode details: MAC times, size, block list
istat -f ext4 /evidence/part2.dd 141003
inode: 141003
md5/dirhash: ...
crtime: 2026-08-10 12:00:01
mtime: 2026-08-11 03:14:07
atime: 2026-08-11 03:14:09
ctime: 2026-08-11 03:14:09
size: 4096
# extract a file's contents by inode (even if deleted)
icat -f ext4 /evidence/part2.dd 141003 > /evidence/deleted_note.txt
cat /evidence/deleted_note.txticat reads a file's data directly from the inode's block pointers. If the inode
hasn't been reused, this recovers a deleted file without any carving — clean, fast,
and with its original content.
# -A = unallocated blocks only
blkls /evidence/part2.dd -A > /evidence/unallocated.bin
# feed it to a carver (foremost/scalpel) or grep it
strings /evidence/unallocated.bin | grep -i "password" | head| Tool | Layer | Purpose |
|---|---|---|
| mmls | Volume | Partition table layout |
| mmcat | Volume | Extract a partition as its own image |
| fsstat | FS | Filesystem details & statistics |
| fls | FS | List files/dirs; shows deleted entries |
| istat | FS | Inode metadata (MAC times, blocks) |
| icat | FS | Dump a file's content by inode |
| blkls | FS | Extract allocated/unallocated blocks |
| fsck-ls / fsck-istat | FS | Use the fsck cache instead of live FS |
| sigfind / hfind | Raw | Find signatures; hash-lookup in databases |
# 1. understand the disk
mmls /evidence/image.dd
# 2. isolate the Linux partition
mmcat /evidence/image.dd 2 > /evidence/part2.dd
# 3. verify the fs type
fsstat -f ext4 /evidence/part2.dd
# 4. build a timeline body file, then a timeline
fls -r -m / -f ext4 /evidence/part2.dd > /evidence/body.txt
mactime -b /evidence/body.txt -d -z UTC > /evidence/timeline.csv
# 5. inspect interesting inodes & extract files
istat -f ext4 /evidence/part2.dd 141003
icat -f ext4 /evidence/part2.dd 141003 > /evidence/recovered_file
# 6. carve unallocated space
blkls /evidence/part2.dd -A > /evidence/unallocated.bin