skills.rest
rjonhaas
rjonhaasCOMMUNITY
Explore all skills by this author →
GitHub

File System & Carving (The Sleuth Kit / EWF Tools)

Verify, mount read-only, enumerate filesystems, and carve artifacts from E01/EWF images with Sleuth Kit and EWF tools.

1|Updated Apr 25, 2026
Search Tags:#dfir#timeline generation#evidence integrity#forensic image analysis#disk carving#sleuth kit#ewf
One-click install
npx skills add https://github.com/rjonhaas/SIFTics --skill file-system-carving-the-sleuth-kit-ewf-tools
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: File System & Carving (The Sleuth Kit / EWF Tools)
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/sleuthkit
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill file-system-carving-the-sleuth-kit-ewf-tools

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It solves the problem of extracting files, deleted artifacts, and filesystem timelines from E01/EWF disk images while preserving evidence integrity and using consistent forensic workflows.

Core Features & Use Cases

  • Image verification and integrity checks: Use EWF tools to confirm image metadata and ensure hashes verify before analysis begins.
  • Read-only mounting and filesystem inspection: Mount E01 images read-only, inspect sector/partition layout, and gather filesystem metadata.
  • TSK-based navigation, extraction, and carving: Enumerate inodes and deleted entries, extract file contents by inode/MFT, and recover allocated/unallocated artifacts; generate bodyfile timelines and carve with bulk extraction or signature-based tools.

Use case: When investigating a suspected Windows compromise from an E01 acquisition, verify the image, map partitions, enumerate and extract key artifacts (MFT, UsnJrnl, prefetch, event logs), recover deleted files, and produce a UTC filesystem timeline for analysis.

Quick Start

Run the sleuthkit workflow for a case by verifying the E01 hashes, mounting the image read-only, then list and extract relevant inodes and carve targeted artifacts from allocated and unallocated space as needed.

Frequently Asked Questions about File System & Carving (The Sleuth Kit / EWF Tools)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract deleted files from an E01 forensic image?▼

You can carve deleted files from E01 disk images by mounting them read-only with ewfmount, then applying Sleuth Kit utilities like fls and icat to enumerate and extract files from unallocated space.

What is the best way to generate a filesystem timeline for DFIR triage?▼

The best way to generate a filesystem timeline for DFIR triage is using Sleuth Kit tools to extract filesystem metadata into a bodyfile, then processing that bodyfile with the mactime utility to produce a chronological UTC timeline for analysis.

How do I verify E01 image integrity before starting forensic analysis?▼

You verify E01 image integrity before forensic analysis by running EWF tools like ewfverify and ewfinfo to confirm image metadata and ensure cryptographic hashes match the original acquisition, preserving evidence validity.

Does Sleuth Kit work with EWF disk images for Windows filesystem investigations?▼

Yes, Sleuth Kit works with EWF disk images for Windows filesystem investigations by combining ewfmount for read-only access with TSK utilities to enumerate inodes, extract MFT entries, and locate artifacts like prefetch and event logs.

Can I use bulk_extractor and photorec to carve unallocated space from mounted disk images?▼

Yes, you can use bulk_extractor and photorec to carve unallocated space from mounted disk images, applying signature-based extraction to recover targeted artifacts and IOC-bearing strings across Windows filesystems during DFIR triage.

Related Skills

Explore More Legal & Compliance Skills→
lazyFrogLOLlazyFrogLOL
127

password-recovery

Recover passwords and credential data from disk images or corrupted files.

Community
Intermediate
jmaglyjmagly
175

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.

Community
Advanced
SherifEldeebSherifEldeeb
5

registry-forensics

Parse Windows Registry hives to extract artifacts and generate timelines.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

forensic-disk

Analyze disk images read-only with Sleuth Kit, foremost, and bulk_extractor.

Community
Advanced