Alternatives to The Sleuth Kit
Command-line tools and a C library for analysing disk images and recovering files in forensic work. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
The Sleuth Kit
Command-line tools and a C library for analysing disk images and recovering files in forensic work.
Replacements
Listings that take over the same core job as The Sleuth Kit.
Autopsy
Digital forensics platform for disk, file and timeline analysis.
Autopsy puts a graphical case-management interface on The Sleuth Kit, adding keyword search, timelines and reporting, but ingesting large images takes hours.
Similar software
Related functionality, not a direct replacement.
CAINE
Ubuntu-based digital forensics live distribution.
OSFMount
A free Windows utility that mounts disk image files as drives and creates RAM disks.
Volatility 3
Memory forensics framework for extracting artefacts from RAM images.
Velociraptor
Endpoint monitoring and digital forensics platform driven by a query language.
unblob
Command-line extraction tool that finds and unpacks archives and compressed streams inside arbitrary binary files.
REMnux
Linux toolkit for reverse engineering and analysing malicious software.
