So, first, let's cover some of the basics.
Sleuth Kit is a collection of command line tools that
allows investigators to analyze disk images,
particularly volume and filesystem data.
It allows you to input a large variety of digital artifacts,
even some proprietary formats used by other tools to
perform digital forensics investigations.
This tool helps perform analysis on file system artifacts,
including raw disk images, allocated and deleted file names, and
TFS contents and attributes, among others.
And the good news is Sleuth Kit is a free and open source project.
The other tool that we're going to be taking a look at today is
Autopsy. Autopsy is a graphical user interface or GUI complementary
to the Sleuth Kit and other forensic tools.
It is essentially a case management system that allows you to
collaborate with other investigators. Within Autopsy, there are
both native and third‑party modules that provide capabilities
such as timeline analysis, data carving,
multimedia EXIF extraction, and keyword searches.