scalpel

2013년 6월 27일부로 Scalpel은 Apache 2.0 라이선스로 배포되었으며 소스 코드는 The Sleuth Kit GitHub 저장소에서 확인할 수 있습니다. 현재 적극적으로 유지보수되지는 않습니다. Autopsy 팀이 Java/JNI 바인딩을 통해 긴밀하게 통합하는 작업을 시작했지만, 여러 메모리 누수가 발생하여 해당 작업은 중단되었습니다. 공식 릴리스는 이루어지지 않고 있습니다. 풀 리퀘스트를 제출할 수는 있지만, 검토되는 데 시간이 걸릴 수 있습니다. Scalpel은 Linux와 Windows에서 실행되는 파일...

sleuthkit

The Sleuth Kit 소개 The Sleuth Kit은 Microsoft 및 UNIX 파일 시스템과 디스크를 분석하기 위한 오픈 소스 포렌식 도구 키트입니다. The Sleuth Kit을 사용하면 조사관이 침해 대응 중에 획득한 이미지나 라이브 시스템에서 증거를 식별하고 복구할 수 있습니다. The Sleuth Kit은 오픈 소스이므로 조사관이 도구의 동작을 검증하거나 특정 요구에 맞게 사용자 지정할 수 있습니다. The Sleuth Kit은 Wietse Venema와 Dan Farmer가 만든 The Coroner's...

autopsy

Autopsy 4 http://www.sleuthkit.org/ 2016년 3월 15일 개요 Autopsy는 The Sleuth Kit 및 기타 오픈 소스 디지털 포렌식 도구를 위한 그래픽 인터페이스입니다. Autopsy 3는 Java 기반으로 만들기 위해 Autopsy 2에서 완전히 다시 작성되었습니다. Autopsy 4는 여러 사용자가 단일 사례를 공동 작업할 수 있도록 지원하여 Autopsy 3를 개선했습니다. Autopsy는 크로스 플랫폼Windows, Linux, MacOSX으로 설계되었지만, 현재 버전은...

Autopsy 4.23.1

Autopsy is the premier end-to-end open source digital forensics platform. Built by Sleuth Kit Labs with the core features you expect in commercial forensic tools, Autopsy is a fast, thorough, and efficient hard drive investigation solution that evolves with your needs...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: sleuthkit (UTSA-2026-014271)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014271 advisory. The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tskrecover that allows an attacker to write files to arbitrary locations outside the intende...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: sleuthkit (UTSA-2026-014269)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014269 advisory. The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parsesusp function trusts lenid, lendes, and...

OESA-2026-1935 sleuthkit security update

The Sleuth Kit previously known as TASK is a collection of UNIX-based command line file system forensic tools that allow an investigator to examine NTFS, FAT, FFS, EXT2FS, EXT3FS and ExFAT file systems of a suspect computer in a non-intrusive fashion. The tools have a layer-based design and can...

OESA-2026-1937 sleuthkit security update

The Sleuth Kit previously known as TASK is a collection of UNIX-based command line file system forensic tools that allow an investigator to examine NTFS, FAT, FFS, EXT2FS, EXT3FS and ExFAT file systems of a suspect computer in a non-intrusive fashion. The tools have a layer-based design and can...

OESA-2026-1934 sleuthkit security update

The Sleuth Kit previously known as TASK is a collection of UNIX-based command line file system forensic tools that allow an investigator to examine NTFS, FAT, FFS, EXT2FS, EXT3FS and ExFAT file systems of a suspect computer in a non-intrusive fashion. The tools have a layer-based design and can...

Sleuth Kit tsk_recover Path Traversal

...

Sleuth Kit APFS Keybag Parser Out-of-Bounds Read

...

Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read

...

SUSE CVE-2026-40024

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tskrecover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can...

SUSE CVE-2026-40025

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrappedkeyparser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS...

SUSE CVE-2026-40026

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parsesusp function trusts lenid, lendes, and lensrc fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SU...

CVE-2026-40025

A flaw was found in The Sleuth Kit. An attacker can exploit this vulnerability by crafting a malicious Apple File System APFS disk image. This flaw allows for an out-of-bounds read in the APFS filesystem keybag parser, specifically within the wrappedkeyparser class, due to a lack of bounds checki...

CVE-2026-40026

A flaw was found in The Sleuth Kit's ISO9660 filesystem parser. An attacker can craft a malicious ISO image that exploits an out-of-bounds read vulnerability in the parsesusp function. This vulnerability occurs because the function trusts length fields from the disk image without proper validatio...

EUVD-2026-20759

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tskrecover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can...

EUVD-2026-20761

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrappedkeyparser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS...

EUVD-2026-20763

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parsesusp function trusts lenid, lendes, and lensrc fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SU...