Tools and Libraries that are used by The Sleuth Kit

(in alphabetical order)

• AFFLib (AFF image format support)
• [ftp://ftp.astron.com/pub/file/ file] (detects file type)
• libewf (EnCase / Expert Witness image format support)

File Hash Databases

(in alphabetical order)

• CyberAbuse Rootk(it)ID project
• Hash Keeper
• KnownGoods
• NIST NSRL SW Fingerprint Database
• RPM Use on Linux systems with ‘-V -a’ to identify binaries that are different than the local database says
• Solaris Fingerprint Database