sleuthkit 话题在 GitHub 上没有填写简介，这里按 Star 数汇总最相关的热门仓库。
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.
A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.
Forensic Analysis Tool for Btrfs File System.
A series of Linux and Windows based Forensics labs. Tools used include: FTK, EnCase, Sleuthkit, Autopsy, Volatility, etc.
A hands-on, 8-part Capture the Flag (CTF) curriculum covering cryptography, web exploitation, networking, digital forensics, and reverse engineering.
Forensic analysis of disk images, smartphone extractions (iPhone, Android) and drone flight logs, with an optional local, offline AI assistant. Sleuth Kit, plaso, libyal, iLEAPP/ALEAPP. Windows, Mac, Linux.
A fork of The Sleuthkit with XFS filesystem support. See PR https://github.com/sleuthkit/sleuthkit/pull/1476 for more info.
Collection of popular DFIR tools in a lightweight and fast docker image
NBTempoW V. 2.1 是一款用于从块设备图像文件（RAW、ewf、物理驱动器等）制作时间线的取证工具。它使用 TSK（The Sleuthkit），并采用 Lazarus V. 1.6.2（兼容 Delphi 的跨平台集成开发环境，用于快速应用开发）开发。它只在Windows上运行。如果设备映像文件是拆分的，你可以只选择第一个片段。
🕵️ An AI-powered forensic orchestration engine for automated disk and memory analysis. Bridges the gap between raw data and actionable intelligence using LLMs (DeepSeek/OpenRouter).
Python tool to extract File slacks from disk images.
开源法医成像与文件切割套件，可从原始磁盘、USB驱动器、SD卡或磁盘镜像中恢复40+格式（JPEG、PNG、PDF、DOCX、MP4、ZIP、WAV等）。创建逐位副本，SHA-256/MD5/SHA-1 三重哈希，记录保管链，通过 Sleuth Kit 导出已删除的条目，并执行基于多线程的签名。
Linux command line thumbstick file recovery script using SleuthKit
File recovery made ridiculously simple. Recover deleted files, find lost partitions, back up failing HDDs, SSDs, SD cards, and USB drives.
Removes Claude Code cyber safety checks in source for security research and testing
A Bash script that utilizes The Sleuth Kit to recover directories in their entirety
Recover normal and deleted files from a partition
Use Autopsy Tool in Dark Mode
Forensic Inode Analysis