Sleuthkit

• commands for digital forensics

• focus on data extraction and recovery

Tools

• [[mmls]]

  • see img partitions

• [[fls]]

  • view files/dirs

• [[icat]]

  • cat but prioritize preserve evidence and more format capabilities

• [[srch_strings]]