Basic intro to The Sleuth Kit command line tools

Basic intro to The Sleuth Kit command line tools with two example use cases

♥️ SUBSCRIBE for more videos: https://www.youtube.com/bluemonkey4n6...


Difficulty Level: Beginner to Intermediate
Prerequisites: basic understanding of linux command line
Prerequisites: basic understanding of filesystems

In this video, we will look at The Sleuth Kit (TSK), a library and collection of command line tools that allow one to examine disk images. TSK is used to find evidence within digital evidence and the library has been used in conjunction with larger DFIR tool kits.


Video timeline
00:00 intro
01:18 Image level tools - img_stat
03:25 Volume level tools - mmls, mmcat, mmstat
07:53 File System tools - fsstat
11:01 Detour to Logical Volume Management setup
12:53 File System tools - fls
17:55 Application 1 - timeline analysis - fls, mactimeb
21:26 Application 2 - file extraction or recovery - ifind, icat, ils


🔨 Gear mentioned in this video:

File System Forensic Analysis by Brian Carrier: https://amzn.to/3QB5268


⭕️ For a Logical Volume Management basic tutorial, watch this video here:    • Logical Volume Manager (LVM) - basics...  
Other videos which the bluemonkey4n6 AI engine believes you would enjoy:
Reading Linux filesystems with Windows:    • Reading Linux filesystems with Window...  
RAID tutorial:    • Redundant Array of Independent Disks ...  
DFIR EDC pack:    • DFIR EDC pack  - my EveryDay Carry pa...  


Linux distros:
CAINE  linux (http://www.caine-live.net)
ParrotOS (http://parrotsec.org)

Sleuth Kit download page: http://www.sleuthkit.org/sleuthkit/do...
Sleuth Kit downloads: https://github.com/sleuthkit/sleuthki...

Icons made by freepik from @flaticon http://www.flaticon.com/authors/freepik

Icons made by Smashicons from @flaticon http://www.flaticon.com/authors/smash...

Music by Lensko: Let’s Go


DISCLAIMER: Links in this video description might be affiliate links. If you purchase a product or service using one of these links, I may receive a small commission at no additional cost to you. Thank you!

#DFIR #linux #sleuthkit