The Sleuth Kit
Where is it used?
The agentless collection tool uses The Sleuth Kit to find and copy files for both live systems and disk images.
Why is it useful?
Allows Cyber Triage to access locked files, does not modify timestamps, and allows it to see files hidden by attacker.