The Sleuth Kit

No entries match these filters. Clear filters

1. sleuthkit-4.14.0 Apr 15, 2025 · release notes

   Sleuth Kit 4.14.0 adds Windows BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. support to the CLI

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.14.0 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.14.0

   • Adds BitLocker support for Windows disk images (Windows host only)
   • Updates LibVMDK library integration
   • Updates LibVHDI library integration

   3 details in Everything

2. sleuthkit-4.13.0 Mar 11, 2025 · release notes

   Sleuth Kit 4.13.0 adds BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. support and experimental btrfs/xfs parsing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.13.0 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.13.0

   • Added BitLocker support for Windows images, enabling the tool to read encrypted volumes.
   • Added support for btrfs (experimental) and xfs (experimental) file system parsing.
   • Updated logical folder caching to improve performance when traversing directory structures.

   3 details in Everything

3. sleuthkit-4.12.1 Aug 29, 2023 · release notes

   Adds java File Repository concept for external file storage and updates schema to 9.4

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.12.1 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.12.1

   • Adds File Repository concept in the Java bindings for storing files in an alternative location
   • Updates the Java binding schema version to 9.4

   2 details in Everything

4. sleuthkit-4.12.0 Jan 25, 2023 · release notes

   The Sleuth Kit 4.12.0 adds LVM and Logical File System support for disk image analysis.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.12.0 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.12.0

   • Adds LVM support (non-Windows) to enable parsing of Logical Volume Manager volumes within disk images
   • Adds Logical File System support to parse folder structures directly from disk images

   2 details in Everything

5. sleuthkit-4.11.0 Aug 2, 2021 · release notes

   Adds tsk_imageinfo CLI tool and new Java data model tables for hosts, artifacts, and file attributes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.11.0 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.11.0

   └──▷ USE IT
   Check if a disk image is supported and whether it is encrypted before attempting full analysis.
   shell copy

   tsk_imageinfo -e /path/to/image.dd

   Access the new File Attribute table in Java to store and retrieve custom metadata for each file artifact.
   java copy

   FileAttrTable attrTable = db.openFileAttrTable();
   attrTable.addRow(fileObj, "custom_key", "custom_value");

   • Adds the tsk_imageinfo command-line utility to detect supported image formats and encryption status
   • Adds new Java API tables and classes for OS Accounts, Realms (Domains), Host Addresses (IP/MAC), and File Attributes
   • Improves file search performance in the Java API by using indexed extension lookups in findFile methods

   3 details in Everything

6. sleuthkit-4.10.2 Mar 23, 2021 · release notes

   Adds Ext4 inline data support and new Blackboard Artifacts (Yara, ALEAPP/ILEAPP) to TSK 4.10.2

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.10.2 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.10.2

   • Added C/C++ support for reading Ext4 inline data
   • Added SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. column to the files table in the Java DB layer
   • Changed TimelineManager to generate events for any artifact with a timestamp

   3 details in Everything

7. sleuthkit-4.10.0 Sep 9, 2020 · release notes

   The Sleuth Kit 4.10 adds Java callback support for DB inserts and CASE/UCO JSON-LD export.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.10.0 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.10.0

   • Adds Java callback support so that database inserts are done in Java
   • Added TaggingManager class and concept of a TagSet to support ProjectVic categories
   • Added a CASE/UCO JAR file that creates JSON-LD based on TSK objects

   3 details in Everything

8. sleuthkit-4.9.0 May 1, 2020 · release notes

   Sleuth Kit 4.9.0 adds APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices. unallocated space virtual files, pool CLI args, and GPS artifact support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.9.0 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.9.0

   • Adds --pool command line arguments to all command line tools for handling disk images as pools
   • Creates virtual files to expose APFS unallocated space content within the analysis framework
   • Inserts GPS artifacts into the timeline events table via the updated TimelineManager

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The C/C++ framework project has been removed; users requiring an analysis framework must now use Autopsy.
9. sleuthkit-4.8.0 Jan 24, 2020 · release notes

   Adds APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices. pool layer support and data source deletion API in The Sleuth Kit 4.8.0

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch sleuthkit-4.8.0 https://github.com/sleuthkit/sleuthkit.git
   # already have the repo? check out this version:
   $ git checkout sleuthkit-4.8.0

   • Adds Pool class and associated infrastructure to support APFS file systems in both C/C++ (libtsk) and Java APIs
   • Updates DB schema to support pools, JSON in Blackboard Attributes, and cascading deletes for data source removal
   • Adds attachment support to the blackboard helper package in the Java API

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Removed JavaFX as a dependency by refactoring the recently introduced timeline filtering classes
10. sleuthkit-4.7.0 Oct 14, 2019 · release notes

    Sleuth Kit 4.7 adds postArtifact() method for event broadcasting and Logical Imager VHD export removal

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.7.0 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.7.0

    • Adds postArtifact() method to Blackboard Helper packages for adding event data to database and broadcasting listeners

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Logical Imager no longer saves files in VHD by default; individual file format is now the standard
11. sleuthkit-4.6.7 Aug 2, 2019 · release notes

    First release of new logical imager tool and expanded Communications Manager API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.6.7 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.6.7

    • Introduces the logical_imager CLI tool as a new capability for automated forensic acquisition

    1 detail in Everything

12. sleuthkit-4.6.6 Apr 26, 2019 · release notes

    Adds CaseDbManager methods and acquisition details API for E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. images in The Sleuth Kit 4.6.6

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.6.6 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.6.6

    • Adds api methods to CaseDbManager for getting and setting acquisition details (e.g., for E01 files)
    • Adds api methods to CaseDbManager for adding volume and file systems to the database
    • Adds api method to CaseDbManager for adding LayoutFile for allocated files

    3 details in Everything

13. sleuthkit-4.6.5 Jan 15, 2019 · release notes

    SleuthKit 4.6.5 adds new artifacts, attributes, and hash fields to the case database schema

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.6.5 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.6.5

    • Adds new artifacts and attributes definitions to expand detection surface for digital forensics cases
    • Adds new fields for hash values and acquisition details in the SleuthKit case database (SleuthkitCase)
    • Stores the created schema version string in the case database to track schema origins

    3 details in Everything

14. sleuthkit-4.6.3 Oct 15, 2018 · release notes

    Adds examiner table and tag association in Sleuth Kit 4.6.3

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.6.3 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.6.3

    └──▷ TRY IT
    Inspect new examiner metadata in the internal database.
    copy

    $ sqlite3 tsk_db.sqlite "SELECT * FROM examiner;"

    • Adds the Examiner table to the database schema
    • Allows tags to be associated with Examiners
    • Changes parent_path for logical files to match FS file paths

    3 details in Everything

15. sleuthkit-4.6.2 Aug 8, 2018 · release notes

    Sleuth Kit 4.6.2 adds TSK APIs for data source queries and Java thread safety improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.6.2 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.6.2

    • Adds new API support for executing more complex queries against the data source.
    • Adds memory-based caching in the detection logic to optimize checking if an object has children.
    • Adds increased locking in the Java bindings to prevent handle closure conflicts during multi-threaded access.

    3 details in Everything

16. sleuthkit-4.6.1 May 8, 2018 · release notes

    Adds Java APIs for graph view of communications and allows reports as URLs/Content

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.6.1 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.6.1

    • Adds graph_view APIs to the Java bindings to generate communication graphs.
    • Allows report outputs to be specified as URLs (Reports can be URLs).
    • Changes report output format to standard Content types (Reports are Content, version upgraded to 8.0).

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The jni library name now includes the user name, potentially breaking existing scripts expecting the default JNIJNIJava Native Interface, a standard Java SE feature that lets Java code call and be called by native C or C++ libraries, giving cyber tools a bridge between JVM-hosted logic and low-level system code. library name.
17. sleuthkit-4.6.0 Feb 21, 2018 · release notes

    Adds Java API for communications and Blackboard artifacts as Content objects

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.6.0 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.6.0

    • Adds new Communications-related Java classes to expose communication data via the Java API
    • Changes Blackboard artifacts to inherit from Content in the Java API, stored in the tsk_objects database table

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Blackboard artifacts are now represented as Content objects instead of their previous artifact-specific class structure in the Java API
18. sleuthkit-4.5.0 Oct 16, 2017 · release notes

    Adds LZVN HFS support, E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. sector size inference, new Local Directory DB type, and attachment hierarchy in tsk_db

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.5.0 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.5.0

    └──▷ TRY IT
    Query the database for files with a specific extension using the new tsk_files.extension column
    copy

    $ sqlite3 tsk_db.db "SELECT name, extension FROM tsk_files WHERE extension = '.log';"

    Check the database schema to verify the new Local Directory type is available alongside standard types
    copy

    $ sqlite3 tsk_db.db "SELECT DISTINCT obj_type FROM tsk_objects WHERE obj_type IN ('Local Directory', 'Virtual Directory');"

    • Adds lzvn decompression support for HFS files via the LZVN codec.
    • Enables reading sector size directly from E01 images instead of assuming 512 bytes.
    • Adds a new Local Directory DB schema type to distinguish from Virtual Directories.
    • Allows blackboard artifacts in the DB to have hierarchical parent-child relationships for message attachments.
    • Adds the extension column to the tsk_files table in the database.

    5 details in Everything

19. sleuthkit-4.4.2 Aug 7, 2017 · release notes

    Adds usnjls CLI tool for NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. USN log analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sleuthkit-4.4.2 https://github.com/sleuthkit/sleuthkit.git
    # already have the repo? check out this version:
    $ git checkout sleuthkit-4.4.2

    └──▷ USE IT
    Parse an NTFS USN journal to track file modifications and deletions.
    shell copy

    usnjls -f /path/to/image.img

    • usnjls command-line tool added for parsing NTFS USN logs
    • Blackboard Artifacts now expose a shortDescription method

    2 details in Everything