---
name: sleuthkit
description: Perform disk-image and filesystem forensics with The Sleuth Kit and EWF utilities on SANS SIFT, including integrity verification, read-only mounting, partition and filesystem inspection, deleted-file recovery, bodyfile timelines, artifact extraction, carving, and hash verification.
---

# Sleuth Kit Filesystem Forensics

Use this skill for disk-image inspection, filesystem navigation, file extraction, deleted-file recovery and carving on SANS SIFT. Evidence must remain read-only. Record acquisition hashes before analysis and keep analyst-generated files outside the evidence mount.

## Main tools

`ewfinfo`, `ewfverify`, `ewfmount`, `img_stat`, `mmls`, `fsstat`, `fls`, `icat`, `istat`, `ffind`, `ils`, `blkls`, `tsk_recover`, `mactime`, `bulk_extractor`, and `photorec`.

## Workflow

### 1. Verify EWF evidence

```bash
ewfinfo /cases/<CASE>/<image>.E01
ewfverify /cases/<CASE>/<image>.E01
```

Do not continue silently if verification fails. Record the expected and calculated hashes in the case notes.

### 2. Expose the EWF image without modifying it

```bash
sudo mkdir -p /mnt/ewf /mnt/evidence_ro
sudo ewfmount /cases/<CASE>/<image>.E01 /mnt/ewf/
ls /mnt/ewf/
```

For segmented EWF sets, provide the first segment and let the EWF library assemble the set.

### 3. Determine sector size and partition layout

```bash
img_stat /mnt/ewf/ewf1
sudo mmls /mnt/ewf/ewf1
```

Never assume 512-byte sectors. Calculate byte offsets from the reported sector size and partition start sector.

### 4. Inspect and mount the target filesystem read-only

```bash
sudo fsstat -o <START_SECTOR> /mnt/ewf/ewf1
OFFSET=$(( <START_SECTOR> * <SECTOR_SIZE> ))
sudo mount -o ro,loop,offset=${OFFSET} /mnt/ewf/ewf1 /mnt/evidence_ro
```

For dirty NTFS volumes, consider a read-only no-recovery mount so journal replay does not alter state:

```bash
sudo mount -o ro,loop,norecovery,offset=${OFFSET} /mnt/ewf/ewf1 /mnt/evidence_ro
```

### 5. Enumerate files and deleted entries with TSK

```bash
sudo fls -r -p -o <START_SECTOR> /mnt/ewf/ewf1 > ./analysis/fls_output.txt
sudo fls -r -m / -o <START_SECTOR> /mnt/ewf/ewf1 > ./analysis/bodyfile.txt
```

Use `fls` output to identify inode/MFT record numbers, deleted entries and paths of interest.

### 6. Inspect and recover specific files

```bash
sudo istat -o <START_SECTOR> /mnt/ewf/ewf1 <INODE>
sudo ffind -o <START_SECTOR> /mnt/ewf/ewf1 <INODE>
sudo icat -o <START_SECTOR> /mnt/ewf/ewf1 <INODE> > ./exports/files/<name>
sudo icat -r -o <START_SECTOR> /mnt/ewf/ewf1 <INODE> > ./exports/files/<recovered_name>
```

Hash recovered content immediately and keep recovered copies separate from the evidence image.

### 7. Review inode and unallocated space

```bash
sudo ils -o <START_SECTOR> /mnt/ewf/ewf1 > ./analysis/ils_output.txt
sudo blkls -A -o <START_SECTOR> /mnt/ewf/ewf1 > ./analysis/unallocated.raw
```

Use block-level extraction when the investigative question requires deleted data or carving. Avoid generating huge unallocated files without first checking disk space.

### 8. Bulk recover files

```bash
sudo tsk_recover -o <START_SECTOR> /mnt/ewf/ewf1 ./exports/tsk_recover/
```

Use the tool's allocation/deletion options intentionally and record which mode was used.

### 9. Build a filesystem timeline

```bash
sudo fls -r -m / -o <START_SECTOR> /mnt/ewf/ewf1 > ./analysis/bodyfile.txt
mactime -b ./analysis/bodyfile.txt -z UTC > ./exports/fs_timeline.txt
mactime -b ./analysis/bodyfile.txt -z UTC -d > ./exports/fs_timeline.csv
```

Correlate this timeline with Plaso, event logs, registry, memory and application artifacts.

### 10. Extract common Windows artifacts

When working with a mounted Windows volume, common targets include:

- `Windows/System32/winevt/Logs/*.evtx`
- `Windows/System32/config/{SYSTEM,SOFTWARE,SECURITY,SAM}`
- each user's `NTUSER.DAT` and `UsrClass.dat`
- `Windows/Prefetch/*.pf`
- `$MFT` and `$UsnJrnl:$J`
- `Windows/AppCompat/Programs/Amcache.hve`
- `Windows/System32/sru/SRUDB.dat`
- browser History/Cookies databases
- Recycle Bin and scheduled-task files

Prefer forensic extraction methods such as `icat` where record numbers are known, and preserve source paths in your notes.

### 11. Carving

Use `bulk_extractor` for feature-oriented extraction and `photorec` for signature-based file recovery. Point outputs at analyst-controlled export directories, never the evidence mount.

Example:

```bash
sudo bulk_extractor -o ./exports/carved/ /mnt/ewf/ewf1
```

### 12. Unmount cleanly

Unmount in reverse order:

```bash
sudo umount /mnt/evidence_ro
sudo umount /mnt/ewf
```

## Forensic interpretation rules

- A deleted directory entry does not guarantee file content is still recoverable.
- Filesystem timestamps can be altered by applications, copy operations or anti-forensic activity.
- Wrong sector size or partition offset invalidates downstream interpretation.
- `norecovery` is important when avoiding NTFS journal replay on a forensic mount.
- Correlate recovered files with hashes, MFT/USN records and other independent evidence.

## Output layout

Use `./analysis/` for listings/bodyfiles and `./exports/` for recovered files, artifact collections, timelines and carving results.