Download The Sleuth Kit 3.0.1

The program The Sleuth Kit is a collection of forensic tools that can be used to take a closer look at the hard drive. This makes it possible to retrieve or partially view deleted files. Support for ntfs, fat, ufs1, ufs2, ext2fs, ext3fs, and iso 9660 formats is provided. For more information, we refer you to this page. The developers recently released version 3.0.1 with the following changes:

Version 3.0.1:

This release contains several bug fixes. No new features.

Version 3.0.0:

This major release contains many new library and tool features.

• Orphan files (deleted files that have a metadata structure, but do not have a parent directory that can be reached from the root directory) are now shown in the $OrphanFiles directory.
• The FAT file system MBR and File Allocation Tables are now accessible as files in the root directory.
• More deleted files are shown in each directory when using ‘fls’ (and the corresponding library API). This used to require running ‘ifind -p’ for each directory and it is now done automatically.
• New mmcat tool to output contents of a single volume.
• New mmls flags to list only specific volumes.
• Backup FAT MBRs are used, if the primary is corrupt.
• d* tools (dls, dcat, etc.) are now named blk* (blkls, blkcat, etc.)
• New ‘-b’ option in sorter to specify minimum file size.
• Added mingw support for cross compiling
• New library APIs and docs that do not require a callback design
• Minor bug fixes.