The Sleuth Kit

The Sleuth Kit is a collection of open-source command-line tools for file-system and disk forensic analysis.

It is relevant when a matter requires low-level file-system review, validation, or open-source forensic tooling.

Use it on copies or images rather than casually working from original evidence media.