Digital Forensics

sleuthkit

sleuthkit — The Sleuth Kit — is a collection of command-line tools for examining disk images at the filesystem level. It reads the raw structures directly, so it sees what a normal file browser can’t: deleted files still recoverable in unallocated space, exact timestamps, the layout of the partition table, and the metadata behind every file. It’s the engine underneath autopsy, and the tools are organized in layers — from the media/partition level (mmls) down through the filesystem (fls, fsstat) to individual files and data units (icat, blkcat).

Installed from the AUR; Security → Digital Forensics → sleuthkit. It ships around thirty tools; the ones below are the everyday core.

Two of the core tools

mmls — read the partition layout of an image:

mmls: invalid option -- '-'
Unknown argument
usage: mmls [-i imgtype] [-b dev_sector_size] [-o imgoffset] [-BrvV] [-aAmM] [-t vstype] image [images]
	-t vstype: The type of volume system (use '-t list' for list of supported types)
	-i imgtype: The format of the image file (use '-i list' for list supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-o imgoffset: Offset to the start of the volume that contains the partition system (in sectors)
	-B: print the rounded length in bytes
	-r: recurse and look for other partition tables in partitions (DOS Only)
	-v: verbose output
	-V: print the version
Unless any of these are specified, all volume types are shown
	-a: Show allocated volumes
	-A: Show unallocated volumes
	-m: Show metadata volumes
	-M: Hide metadata volumes

fls — list files and directories, including deleted ones:

fls: invalid option -- '-'
Invalid argument: --help
usage: fls [-adDFlhpruvV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-m dir/] [-o imgoffset] [-z ZONE] [-s seconds] image [images] [inode]
	If [inode] is not given, the root directory is used
	-a: Display "." and ".." entries
	-d: Display deleted entries only
	-D: Display only directories
	-F: Display only files
	-l: Display long version (like ls -l)
	-i imgtype: Format of image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-f fstype: File system type (use '-f list' for supported types)
	-m: Display output in mactime input format with
	      dir/ as the actual mount point of the image
	-h: Include MD5 checksum hash in mactime output
	-o imgoffset: Offset into image file (in sectors)
	-P pooltype: Pool container type (use '-P list' for supported types)
	-B pool_volume_block: Starting block (for pool volumes only)
	-S snap_id: Snapshot ID (for APFS only)
	-p: Display full path for each file
	-r: Recurse on directory entries
	-u: Display undeleted entries only
	-v: verbose output to stderr
	-V: Print version
	-z: Time zone of original machine (i.e. EST5EDT or GMT) (only useful with -l)
	-s seconds: Time skew of original machine (in seconds) (only useful with -l & -m)
	-k password: Decryption password for encrypted volumes

A typical examination

# 1. See the partitions and their offsets
mmls disk.img

# 2. List files in a partition (offset from mmls); -r recurses, -d shows deleted
fls -o 2048 -r disk.img

# 3. Recover a file by its inode number (from fls) to stdout
icat -o 2048 disk.img 18243 > recovered.jpg

# 4. Build a filesystem timeline for a case
fls -o 2048 -m / -r disk.img > body.txt
mactime -b body.txt > timeline.txt

For a point-and-click version of the same underlying engine, use autopsy.