Sleuth Kit

About Sleuth Kit

Law enforcement, the military, and corporate auditors all use it to piece together what transpired on a computer. It can also be used to retrieve lost photographs from a digital camera's memory card. Autopsy performs tasks in the background in parallel across multiple CPU cores and gives you the results as soon as they are found. Although a complete search of the drive could take several hours, you would know within minutes if the user's home folder contained the keywords you were looking for.