An Ontology for Digital Forensics in IT Security Incidents - OPUS

4.3. FORENSIC TOOLS 25
4.3.1 The Sleuth Kit
The Sleuth Kit[Carrier, 2012a] is a collection of programs for analysing the
data on a hard disk respectively on an image of it[Carrier, 2012b]. It was
developed by Brian Carrier, author of [Carrier, 2005]. The programs are subdivided
into categories. The tools are subdivided according to the categories
that are shown in section 4.2.1:[Carrier, 2012c]
• File System
fsstat Shows le system details and statistics including layout, sizes,
and labels. An example output is shown in the appendix in listing
B.1.
• File Name
s Lists allocated and deleted le names in a directory.
• Metadata
icat Extracts the data units of a le, which is specied by its meta
data address (instead of the le name).
Another set of tools can be used to extract the le system structure from a
disk or disk image.
• mmls Displays the layout of a disk, including the unallocated spaces.
For most commands an oset of the beginning of the image is required, as
the image does not necessarily start with the rst partition or the partition
one wants to analyse. The mmls command displays the structure of the
image and the required oset can be read from the output. The output for
the example of section 3.2 is similar to the example given in listing 4.1. In
this example the rst partition starts at 63. The tools for extracting the
information from this partition need to be started with -o 63.
DOS Partition Table
Offset Sector : 0
Units are in 512 - byte sectors
Slot Start End Length Description
00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000000 0000000062 0000000063 Unallocated
02: 00:00 0000000063 0020948759 0020948697 NTFS (0 x07 )
03: ----- 0020948760 0020971519 0000022760 Unallocated
Listing 4.1: Sample output of mmls