The Sleuth Kit: Complete Guide to Digital Forensics and File System Analysis Using Kali Linux

The Sleuth Kit (TSK) is a collection of open-source command-line tools and a C library that allows investigators to analyze disk images and recover files from them. It is the engine that powers Autopsy and many other forensic front ends. TSK operates at multiple layers of a file system — volume/partition layer, file system layer, file name layer, metadata layer, and content/data unit layer — allowing extremely granular analysis of NTFS, FAT, ExFAT, Ext2/3/4, HFS+, ISO9660, YAFFS2, and UFS file systems.

Developed originally by Brian Carrier as an extension of The Coroner’s Toolkit (TCT), TSK has become the gold-standard open-source library for low-level forensic file system analysis, capable of examining allocated files, deleted files, and even data hidden in slack space or unallocated clusters.

Key capabilities:

• Partition/volume analysis (mmls)
• File system detail analysis (fsstat)
• Directory and file listing including deleted entries (fls)
• File content extraction by inode/metadata address (icat)
• Metadata layer analysis (istat)
• Timeline creation (fls + mactime)
• Data unit/block analysis (blkcat, blkls)
• String searches with inode mapping (ifind)
• Recovery of deleted files (tsk_recover)
• Hash calculation and comparison (tsk_comparedir, hfind)

Installation

Kali Linux (pre-installed or via APT):

sudo apt update
sudo apt install sleuthkit -y

Verify installation:

tsk_recover -V
fls -V

Expected output:

The Sleuth Kit ver 4.12.1

Manual build from source (latest version):

sudo apt install build-essential autoconf libtool git libafflib-dev libewf-dev -y
git clone https://github.com/sleuthkit/sleuthkit.git
cd sleuthkit
./bootstrap
./configure
make
sudo make install

Syntax

TSK is not a single binary but a suite of tools, each with its own syntax:

mmls [options] image
fsstat [options] image
fls [options] image [inode]
icat [options] image inode > output_file
istat [options] image inode
ifind [options] image
blkls [options] image
blkcat [options] image address
tsk_recover [options] image output_dir
mactime -b bodyfile [options]

Command-Line Options

mmls (partition/volume layout):

Option	Description
-t <type>	Partition table type (dos, mac, bsd, sun, gpt)
-i <type>	Image format (raw, ewf, aff)
-o <offset>	Sector offset to start analysis
-B	Print size of partitions in bytes instead of sectors
-M	Display Master Boot Record only
-r	Recurse into partitions
-v	Verbose output

fls (file listing):

Option	Description
-r	Recurse into subdirectories
-p	Show full path of files
-l	Long format (like ls -l)
-d	List only deleted entries
-a	Display entries for . and ..
-u	Display only undeleted entries
-m <dir>	Output in mactime body-file format with mount point dir
-o <offset>	Sector offset of file system in image
-f <fstype>	File system type override
-z <zone>	Time zone for timestamp display

icat (extract file content by inode):

Option	Description
-o <offset>	Sector offset
-r	Recover deleted file, ignoring size limits
-s	Force display of slack space
-h	Display holes in sparse files

istat (metadata display):

Option	Description
-o <offset>	Sector offset
-z <zone>	Time zone
-B <num>	Number of blocks to display in the block list

tsk_recover:

Option	Description
-a	Recover only allocated files
-e	Recover both allocated and deleted files (default: all)
-d <dir_inum>	Start recovery from specific directory inode
-o <offset>	Sector offset
-f <fstype>	File system type

mactime:

Option	Description
-b <bodyfile>	Input body file generated by fls -m
-d	Output in CSV format
-y	Output dates in ISO 8601 format
-z <zone>	Time zone

Basic Usage

Step 1 — Identify partition layout:

mmls disk1.dd

Expected output:

DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0020971519   0020969472   NTFS (0x07)

Step 2 — Get file system details:

fsstat -o 2048 disk1.dd

Expected output:

FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: NTFS
Volume Serial Number: 6C3A9E1D3A9DFA22
OEM Name: NTFS
Sector Size: 512
Cluster Size: 4096

Step 3 — List files (including deleted):

fls -o 2048 -r -p disk1.dd

Expected output:

r/r 4-128-4:	Users/Admin/Documents/report.docx
r/r * 12-128-1:	Users/Admin/Downloads/invoice.pdf (deleted)
d/d 34-128-3:	Users/Admin/Pictures

Practical Examples with Output

Example 1: Full partition listing

mmls -t dos disk1.dd

Output:

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  000:000   0000002048   0020971519   0020969472   NTFS (0x07)

Example 2: Extracting a deleted file by inode

icat -o 2048 -r disk1.dd 12-128-1 > recovered_invoice.pdf
file recovered_invoice.pdf

Output:

recovered_invoice.pdf: PDF document, version 1.6

Example 3: Viewing metadata of a specific file

istat -o 2048 disk1.dd 128

Output:

MFT Entry Header Values:
Entry: 128    Sequence: 3
$LogFile Sequence Number: 88342710
Allocated File
Links: 1

Standard Information Attribute:
Flags: Archive
Created:	2026-06-01 09:15:22
File Modified:	2026-06-14 17:42:03
MFT Modified:	2026-06-14 17:42:03
Accessed:	2026-06-14 17:42:03

Example 4: Generating a body file for timeline analysis

fls -o 2048 -r -m C: disk1.dd > bodyfile.txt
cat bodyfile.txt | head -3

Output:

0|C:/Users/Admin/Documents/report.docx|128-128-1|r/r|0|0|20480|1717232122|1717232122|1717232122|1717228522

Example 5: Creating a readable timeline with mactime

mactime -b bodyfile.txt -d -z UTC > timeline.csv
head -5 timeline.csv

Output:

Date,Size,Type,Mode,UID,GID,Meta,File Name
2026-06-01T09:15:22Z,20480,m...,r/r,0,0,128,C:/Users/Admin/Documents/report.docx
2026-06-14T17:42:03Z,20480,.a.b,r/r,0,0,128,C:/Users/Admin/Documents/report.docx

Example 6: Recovering all deleted files from an image

mkdir recovered_files
tsk_recover -e -o 2048 disk1.dd recovered_files/
ls -la recovered_files/ | head

Output:

Files Recovered: 342
drwxr-xr-x  2 claude claude  4096 Jul 19 10:22 .
-rw-r--r--  1 claude claude 20480 Jul 19 10:22 report.docx
-rw-r--r--  1 claude claude 15230 Jul 19 10:22 invoice.pdf

Example 7: Searching unallocated space for a string’s inode context

ifind -o 2048 -d 40000 disk1.dd

Output:

128

(Indicates inode 128 references data unit 40000.)

Example 8: Extracting raw unallocated space for further carving

blkls -o 2048 disk1.dd > unallocated.raw
ls -lh unallocated.raw

Output:

-rw-r--r-- 1 claude claude 512M Jul 19 10:25 unallocated.raw

Example 9: Checking a specific data block’s content

blkcat -o 2048 disk1.dd 40000 | xxd | head -5

Output:

00000000: 5468 6973 2069 7320 7265 636f 7665 7265  This is recovere
00000010: 6420 636f 6e74 656e 742e 0a00 0000 0000  d content.......

Example 10: Comparing directory contents against known hash set

tsk_comparedir -f nsrl_hashes.idx recovered_files/

Output:

Known Files: 12
Unknown Files: 330

Example 11: File system journal analysis (Ext4)

fsstat -o 2048 ext4disk.dd | grep -A5 "JOURNAL"

Output:

JOURNAL INFORMATION
--------------------------------------------
Journal Inode: 8
Entries: 1024

Example 12: Verbose mmls with byte offsets

mmls -B disk1.dd

Output:

000: Meta      0             512           512           Primary Table (#0)
001: 000:000   1048576       10737418240   10736369664   NTFS (0x07)

Common Use Cases

• Disk image triage: Rapidly enumerate partitions and file systems before deeper analysis.
• Deleted file recovery: Recovering evidence intentionally or accidentally deleted by a suspect.
• Timeline reconstruction: Building MAC(timestamp) timelines of user and system activity for an investigation.
• Slack space and unallocated space analysis: Searching for fragments of deleted or hidden data.
• Backend engine for other tools: TSK underlies Autopsy, PyFlag, and various automated forensic pipelines.
• Cross-validation: Verifying results produced by GUI tools like Autopsy at a granular command-line level for court-admissible precision.

Automation with Bash

#!/bin/bash
# tsk_pipeline.sh - Automated TSK triage pipeline

IMAGE="$1"
OUTDIR="tsk_output_$(date +%Y%m%d_%H%M%S)"

if [ -z "$IMAGE" ]; then
    echo "Usage: $0 <disk_image>"
    exit 1
fi

mkdir -p "$OUTDIR"/{recovered,timeline,logs}

echo "[*] Analyzing partition table..."
mmls "$IMAGE" | tee "$OUTDIR/logs/mmls.txt"

OFFSET=$(mmls "$IMAGE" | awk '/NTFS|Ext/{print $3}' | head -1)
echo "[*] Detected offset: $OFFSET"

echo "[*] Generating file listing..."
fls -o "$OFFSET" -r -p "$IMAGE" > "$OUTDIR/logs/fls_output.txt"

echo "[*] Generating body file for timeline..."
fls -o "$OFFSET" -r -m C: "$IMAGE" > "$OUTDIR/timeline/bodyfile.txt"
mactime -b "$OUTDIR/timeline/bodyfile.txt" -d -z UTC > "$OUTDIR/timeline/timeline.csv"

echo "[*] Recovering files..."
tsk_recover -e -o "$OFFSET" "$IMAGE" "$OUTDIR/recovered/"

echo "[*] Pipeline complete. Results in $OUTDIR"

Run:

chmod +x tsk_pipeline.sh
./tsk_pipeline.sh disk1.dd

Tips and Best Practices

1. Always determine the correct sector offset with mmls before running any other TSK tool.
2. Use fsstat to confirm file system type rather than assuming from partition table entries.
3. Prefer -r recursion flags carefully on very large images — output can be enormous; redirect to files.
4. Always generate a body file and mactime timeline early in an investigation — it often reveals key events quickly.
5. Use -z to explicitly set time zone; mismatched time zones are a common source of investigative error.
6. Combine TSK output with grep, awk, and sed for powerful custom filtering.
7. Validate recovered files with file and hash them immediately for chain-of-custody documentation.
8. For E01/EWF images, ensure libewf is installed so TSK tools can read the format directly.

Troubleshooting

Problem	Cause	Solution
mmls reports “Cannot determine partition table type”	Raw image with no partition table (single volume)	Use fsstat directly without offset, or try -t gpt/-t mac
fls/icat returns no output	Wrong sector offset specified	Re-run mmls and confirm the correct starting sector
“Error: invalid image offset”	Offset given in bytes instead of sectors	Multiply sector offset by sector size, or use correct unit
Cannot read E01 image	Missing libewf support	sudo apt install libewf-dev and rebuild/reinstall TSK
tsk_recover recovers 0 files	Wrong directory inode or empty file system	Use -e flag and verify offset; check with fls first
mactime shows garbled timestamps	Wrong time zone flag	Use -z UTC or the correct system time zone
Slow performance on large images	Reading directly from slow media (USB/network)	Copy image to local fast SSD storage before analysis

References

• Official website: https://www.sleuthkit.org
• GitHub repository: https://github.com/sleuthkit/sleuthkit
• TSK Documentation Wiki: https://wiki.sleuthkit.org
• Kali Linux Sleuth Kit tool page: https://www.kali.org/tools/sleuthkit/
• Brian Carrier, “File System Forensic Analysis” (Addison-Wesley) — foundational reference text
• NIST CFReDS test images: https://cfreds.nist.gov