Command-line tool

sleuthkit

brew/sleuthkit

Checked 25 Oct 2026, 21:09 UTC · Listing refreshed from Homebrew, winget, npm, Scoop and cargo; npm packages checked against OSV.dev

Forensic toolkit

Website

At a glance

Type

Command-line tool

Install on

Windows, macOS, Linux

Last checked

25 Oct 2026, 21:09 UTC

Install it

Windows

scoop install sleuthkit

macOS

brew install sleuthkit

Linux

brew install sleuthkit

Build a recursive fls list over a device, output paths will start with C

fls -r -m C: /dev/loop1p1

Analyze a single partition, providing the sector offset at which the filesystem starts in the image

fls -r -m C: -o sector path/to/image_file

Analyze a single partition, providing the timezone of the original system

fls -r -m C: -z timezone /dev/loop1p1

Related command-line tools

• networkminer
  Network Forensic Analysis Tool
• bulk_extractor
  Stream-based forensics tool
• chainsaw
  Rapidly Search and Hunt through Windows Forensic Artefacts
• dc3dd
  Patched GNU dd that is intended for forensic acquisition of data
• Cloudflare DLP Forensic Copy Decoder
  Cloudflare DLP Forensic Copy Decoder (Windows package; no description in the winget index) go tui golang cloudflare…
• afflib
  Advanced Forensic Format
• hayabusa
  Sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
• dcfldd
  Enhanced version of dd for forensics and security

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents