| | 1 | = SleuthKit = |
| | 2 | The [http://www.sleuthkit.org/sleuthkit/ SleuthKit] is a collection of UNIX-based command line tools that allow you to investigate a computer. The current focus of the tools is the file and volume systems and TSK supports FAT, Ext2/3, NTFS, UFS, and ISO 9660 file systems. |
| | 3 | |
| | 4 | [wiki:ralf] uses SleuthKit to obtain the iNode information for the file requested to restore, and to extract the corresponding data blocks to an image file, thus restricting the space to search for [wiki:foremost] and PhotoRec. |
| | 5 | |
| | 6 | For more details on the SleuthKit, please visit the [http://www.sleuthkit.org/sleuthkit/ project site]. |
