Sleuthkit Python Packages

ntfsdump

A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.

ntfsfind

A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.

slack-handler

Python tool to extract File slacks from disk images.

deep-recover

Recover deleted files from disk images using filesystem-metadata parsing (pytsk3) and raw signature carving. Two-engine recovery for USB drives, SD cards, and disk images — real filenames when the filesystem index survives, raw carving as fallback when it doesn't.

edf-fossil

A post-mortem analysis tool for raw disk/partition images