_ ReconLab
Commands  / Forensics  / The Sleuth Kit

The Sleuth Kit

CLI toolkit for disk & filesystem forensics.

KaliParrotLinuxpassive

pkg: sleuthkit

The Sleuth Kit (fls, icat, mmls, tsk_recover…) analyses disk images at the filesystem level and recovers files.

Syntax

fls -r {image} ; icat {image} {inode}

Example

fls -r disk.img

Recursively lists files (including deleted) in the image.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

mmlsList the partition layout of an image.
flsList files (incl. deleted) in a filesystem.
icatOutput a file by its inode number.
-r <value>Recurse (with fls).

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

sleuthkit

Usage examples

fls -r disk.img

Recursively list files, including deleted ones.

icat disk.img 1234 > recovered.bin

Recover a file by inode.

Advantages
  • Powerful low-level analysis
  • Scriptable; backs Autopsy
Disadvantages
  • CLI learning curve
  • Manual workflow
Tags
#disk#dfir

Official docs: Sleuth Kit ↗

Related commands

Autopsy

GUI digital-forensics platform (Sleuth Kit).

Foremost

Recover files by header/footer carving.

Frequently asked questions

What is The Sleuth Kit used for?
The Sleuth Kit (fls, icat, mmls, tsk_recover…) analyses disk images at the filesystem level and recovers files.
What is an example The Sleuth Kit command?
A common example is: fls -r disk.img — Recursively lists files (including deleted) in the image.
Is The Sleuth Kit part of Kali Linux?
Yes. The Sleuth Kit ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install sleuthkit.
What category of security tool is The Sleuth Kit?
The Sleuth Kit is a Forensics tool with a passive-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →