Frank, a forensic analyst, is working on a case involving a Linux server. The server has been compromised, and Frank suspects the attacker manipulated the file system to hide traces of their activities. He needs a tool capable of in-depth file system analysis on a Linux system. Which tool should Frank use for this task?
Correct Answer: C
Option C. Sleuth Kit is the best answer because CHFI v11 explicitly includes File System Analysis Using Autopsy and The Sleuth Kit (TSK) and also separately lists Linux File System Analysis Tools as core operating-system forensic topics. When the task is specifically to perform in-depth file system analysis on a Linux system , Sleuth Kit is the most direct and appropriate choice among the options.
Sleuth Kit is designed for detailed examination of file systems, including file metadata, deleted entries, directory structures, timelines, and other artifacts that can reveal manipulation or concealment activity. That makes it especially suitable when an attacker may have altered the Linux file system to hide traces. Autopsy is closely related and often uses Sleuth Kit underneath, but the question asks for the tool for in-depth analysis itself, making Sleuth Kit the most precise answer. Extundelete is more specialized for ext-based recovery, not broad forensic file-system analysis. DiskExplorer is not the strongest fit for Linux-focused forensic examination. Therefore, under CHFI objectives, Sleuth Kit is the best answer.