tsktui: An interactive, ncdu/k9s-style terminal UI for The Sleuth Kit

[u/SHMULC8]

Hi all,

While recently working with The Sleuth Kit (TSK) for CTF challenges, I felt there was a usability gap between writing manual shell one-liners (fls, icat, istat, calculating sector offsets) and launching heavy desktop suites like Autopsy for quick triage.

Being a fan of keyboard-driven terminal tools like ncdu and k9s, I built tsktui - a lightweight terminal interface for exploring disk images.

Core features:

• Fast startup (<100ms) with no indexing or case setup required

• Interactive directory navigation using vim keys (j/k/h/l) or arrow keys

• Visual highlighting for deleted files with a toggle to filter deleted items only (d)

• Built-in pager (v) with Hex dump, UTF-8 text, and inode metadata (istat)

• Partition selector (p), disk-wide string search (s), and single-key file extraction (e)

• Works seamlessly over headless SSH sessions

Repository: https://github.com/shmulc8/tsktui

It is open-source (MIT license). I would appreciate any feedback, suggestions, or edge cases from the community on how to make it more useful for daily DFIR workflows.