The Sleuth Kit

Command-line tools for disk and file system forensics.

For

Official source: sleuthkit.orgLast verified: awaiting review · How we check softwareDeveloper: Brian Carrier

What is The Sleuth Kit?

The Sleuth Kit is a library and set of command-line tools for examining disk images and recovering files during forensic investigations.

Supported platforms

Platform	How to get it
Windows	Official website (sleuthkit.org)
macOS	Homebrew (verified)
Linux	APT (verified)

Pricing & licence

Open Source Open Source

Open source: the source code is public, so anyone can inspect it, and it's free to use.

Prices change, so check sleuthkit.org for current pricing.

Installation

macOS

Mac · Homebrew

$ brew install sleuthkit

Install The Sleuth Kit with the rest of your macOS setup

Linux

Linux · APT (Ubuntu and Debian-based)

$ sudo apt install sleuthkit

Install The Sleuth Kit with the rest of your Linux setup

Package names were checked against each official package registry, and commands install the same software as the official download. Only run commands you understand.

Alternatives to The Sleuth Kit

No alternatives listed yet.

Related guides

How to set up a cybersecurity home lab

Build a safe, isolated practice lab with free tools: virtual machines, an analysis machine, a deliberately vulnerable target and packet capture.

8 min read

Set up a new phone securely

Protect your accounts from the first day on a new phone.

5 min read

Autopsy

Security & privacy

A graphical digital forensics platform.

Open Source

Available for Windows, macOS, Linux

View details

The Sleuth Kit FAQ

Is The Sleuth Kit free?

The Sleuth Kit is open source.

Which platforms does The Sleuth Kit support?

The Sleuth Kit is available for Windows, macOS and Linux. It isn't available for Android and iPhone & iPad.

Can I install The Sleuth Kit with Homebrew?

Yes. Run "brew install sleuthkit" in Terminal.

Where can I download The Sleuth Kit safely?

From the official website, sleuthkit.org. Aptorise links only to official sources and never hosts installers.