This is a wrapper for The Sleuth Kit.

Should I build the whole thing or what?

That means you need to build The Sleuth Kit yourself, or use the pre-built Windows binary. Downloading binaries seems to be customary in the the Windows world, so I don't think I need to go into great detail on how to build The Sleuth Kit for yourself - there are great build instructions on sleuth kit.org for you. The main thing we need from TSK are the static libraries. The libtsk-win32 vc++ project included in this package takes those static libraries and exposes them as libtsk3.dll. Then, in the main sleuthkit-sharp project, P/Invoke is used extensively, all of the functions from TSK that are necessary to read a disk, a volume system, a volume, a filesystem, and so on.

Last edited Sep 11, 2011 at 5:25 PM by backstop, version 2

Comments

Selemani Sep 10, 2016 at 6:31 AM 
also i support the idea of akalanka

Selemani Sep 10, 2016 at 6:30 AM 
it seem that this sleuthkit sharp unable to copy file from disk image to local directory

akalanka1986 Sep 15, 2011 at 10:28 AM 
it would be great if there was a sort of a documentation or a guide for some one starting with this...