The Sleuth Kit Alternatives for Disk Forensics

The Sleuth Kit (TSK) is Brian Carrier's open source library and set of command-line tools for examining disk images: listing partitions, walking file systems and pulling out deleted files. It is the engine under Autopsy, which adds the graphical case interface. The project is alive. TSK 4.15.0, released April 15, 2026, is the latest release; sleuthkit.org's download page still offers 4.14.0 (April 15, 2025).

Examiners look past TSK for different reasons. Some want a graphical suite with vendor support and training. Some need phone, cloud or vehicle data that TSK never parsed. Others want what it does not try to do at all: timelines across every log on a disk, or collection from live endpoints. The eight picks below start with commercial disk suites, move to free open source tools, and end with a ready-made forensic workstation. If X-Ways is already on your list, our X-Ways Forensics alternatives guide compares it with the rest of the market.

Prices below are as of November 8, 2026. Our method is on How we review tools.

Quick comparison

X-Ways Forensics

X-Ways Forensics is the commercial tool closest to TSK's way of working. It is built on the WinHex disk editor, shows you the raw structures, and reads FAT, exFAT, NTFS, Ext2 to Ext4, HFS+, APFS, XFS and Btrfs among others. Version 21.9 is current, and it runs portably from a USB stick without installation.

The X-Ways order page prices a 1, 2 or 3 year licence at $1,560 and a perpetual one at $4,035 with updates until November 2027. Discounts start at two licences.

Best for: Examiners who like TSK's direct access to file system structures but want a GUI and faster processing.

Pricing:

• Non-perpetual (1 to 3 years): $1,560; $1,439 each for 2+, $1,330 for 5+
• Perpetual: $4,035 with updates until Nov 2027; longer update periods cost 29% or 66% more
• X-Ways Investigator (perpetual): $2,075
• USD; VAT, GST or sales tax may apply

Watch out for:

• It runs on Windows only, so Linux-based TSK users will need a Windows machine or VM.
• Physical RAM cannot be opened under Windows Vista and later, and dongles cost extra: $44 for a regular one and $220 for a network dongle on perpetual licences.

Official site: X-Ways Forensics.

OSForensics

PassMark's OSForensics suits a small lab moving from free tools, because you can pay by the month. Indexed file search, deleted file recovery, HPA and DCO detection, Volume Shadow Copy browsing and a timeline viewer are in one Windows program. Version 11 is current.

The OSForensics pricing page lists a 30-day free trial and covers two machine installs plus one USB install per licence, all for the same user. Version 10 owners within their support period upgrade free.

Best for: Consultants and small labs who want a supported GUI tool at a known price.

Pricing:

• Trial: free for 30 days
• Subscription: $95 per user per month or $945 per user per year
• Perpetual: $1,680 with 12 months of support, $3,675 with 36 months
• Site licence: contact sales

Watch out for:

• Card-paid subscriptions renew automatically unless you cancel under My subscriptions.
• It is Windows only, and the trial allows a single install.

Official site: OSForensics.

Plaso (log2timeline)

Plaso answers a question TSK's mactime only starts on: what happened on this machine, in order, across every source. Its log2timeline tool pulls timestamped events from file system metadata, logs and other files into one storage file, and psort filters and exports it. pinfo describes a storage file, psteal runs both steps at once, and image_export extracts files.

It reads images through dfVFS, which can use pytsk3, the Python bindings for TSK, so it builds on the engine you know. The latest release, 20261027, reached PyPI on October 29, 2026 under the Apache 2.0 licence.

Best for: Incident responders who need a single timeline across a whole disk image.

Pricing:

• Free and open source (Apache 2.0)

Watch out for:

• Windows users run it through Docker; the Plaso user guide lists packaged installs only for Fedora, macOS and Ubuntu.
• The development release warns of frequent updates and potential breakage, so keep casework on a tagged release.

Official site: Plaso (log2timeline).

Velociraptor

TSK works on images you have already taken. Velociraptor goes to the machines. You deploy a small agent, then query live endpoints in VQL, its query language, to collect files and forensic artifacts, or hunt for an indicator across the fleet. It supports Windows from 7 and Vista onward, Linux and macOS.

Rapid7 backs the project, and the code is open source. The Velociraptor releases page lists 0.77.3 from October 5, 2026 as the latest, a bug fix release that also addresses that cycle's CVEs.

Best for: Security teams who need triage collections from many live hosts, not a single disk image.

Pricing:

• Free and open source

Watch out for:

• The server needs regular patching. Both 0.77.2 and 0.77.3 were released to fix CVEs, and older branches got backports.
• It collects from running systems; for a dead-box image you still need TSK or a disk suite.

Official site: Velociraptor.

Magnet Axiom

Axiom is what many agencies buy when TSK's file system view is not enough. It recovers and reports on mobile, computer, cloud and vehicle data in one case. Version 10.5 is current, and it includes AI-assisted analysis alongside long-standing Connections and Timeline views. Magnet One, Magnet's cloud layer that links its products, is included.

Axiom Cyber is the corporate edition for incident response and eDiscovery, and the Premier licence bundles Griffeye Advanced for media review. The Axiom page offers a free trial through a contact form.

Best for: Labs where cases mix phones, cloud accounts and computers, reviewed by investigators rather than file system experts.

Pricing:

• No public price; contact sales
• Free trial on request

Watch out for:

• There is no list price, so budgeting means a sales call.
• Locked iPhones and Android phones need Graykey, a separate Magnet product that is not sold to the private sector.

Official site: Magnet Axiom.

Belkasoft X

Belkasoft X opens almost any image a mixed lab produces: EnCase, FTK, X-Ways, AFF4, L01, DD, SMART, Atola, DAR and DMG, plus virtual machine disks, memory dumps and Amazon S3 cloud images. It adds phone sources such as GrayKey, UFED and chip-off dumps, and car images in Berla's .ivo format.

The licence is perpetual, which the Belkasoft X page stresses, and a free trial is available. X Corporate includes Belkasoft Remote Acquisition for collecting from machines across a company network.

Best for: Private labs that receive images from many tools and want one perpetual licence for disks and phones.

Pricing:

• No public price; request a quote
• Perpetual licence; free trial

Watch out for:

• Belkasoft X Forensic is sold to government customers only; businesses buy X Corporate.

Official site: Belkasoft X.

Exterro FTK

FTK takes the opposite approach to TSK's on-demand commands. It indexes evidence during ingestion into a database, so later searches do not rescan the disk, and several examiners can work in the same case. Exterro calls this a persistent, database-driven architecture and contrasts it with tools that rely on flat files in memory.

The standalone FTK runs as a self-contained workstation, including in air-gapped labs. FTK Central handles centralised processing, and FTK Connect links forensic workflows to security tools, according to the FTK product page.

Best for: Larger labs that process big cases once and search them many times.

Pricing:

• Physical and virtual licences, price on request

Watch out for:

• Exterro sizes hardware and OS requirements with each buyer, so plan the server with its sales team.

Official site: Exterro FTK.

SIFT Workstation

SIFT keeps TSK and adds everything around it. Rob Lee built the SANS workstation in 2007 for the FOR508 course, and it now bundles TSK with many other free incident response and forensic tools on Ubuntu. The April 21, 2026 build added the Volatility 3 update.

You can import an 8.81 GB virtual machine, install it on Ubuntu 22.04 with the Cast installer, or add it to Windows through WSL. The SIFT Workstation page lists the default login and the install commands.

Best for: Students and responders who want TSK plus a full free toolkit without building it themselves.

Pricing:

• Free

Watch out for:

• Downloading the OVA requires a SANS Portal account.
• Its AI assistant, Protocol SIFT, is labelled experimental, not validated and not court-admissible.

Official site: SIFT Workstation.

How to choose

When to stay with The Sleuth Kit

Stay with The Sleuth Kit if you script your work, process images in batches on Linux, or build your own tools on its C library or the pytsk3 bindings. It costs nothing, runs where you compile it, and the same engine powers Autopsy 4.23.1 when you need a case GUI. Commercial suites earn their price on phones, cloud data and reporting, not on reading NTFS.

Frequently asked questions