[转载]取证工具sleuthkit

信息来源：邪恶八进制信息安全团队（www.eviloctal.com）

The Sleuth Kit (previously known as TASK) is a collection of UNIX-based command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and hidden content is shown.

http://www.sleuthkit.org/