Author: Brian Carrier

Overview

This document was designed to help integrate the Sleuth Kit (TSK) library into an application that needs to analyze data from a disk image. Note that this document does not contain information about using the command line tools in TSK. The command line tools use the functionality of this library, but this document is for programmers who want to use the library.

There are two main sections to this document. One is the User's Guide that describes the organization of TSK, the APIs, and how to use them together. The other is a list of the API functions and a description of their arguments and return values.

User's Guide

The User's Guide describes the various components of TSK and how to use them. It refers to specific functions and data structures with links to the details in the API Reference.

API Reference

The API Reference lists the public C and C++ API functions with their arguments and return values. The Users's Guide should be read first so that the interaction and use of the functions are understood. These pages can also be found in the Modules section.