The Sleuth Kit is the only open source forensic toolkit for a complete
analysis of Microsoft and UNIX file systems.  It enables investigators
to identify and recover evidence from images acquired during incident
response or from live systems.

WWW: http://www.sleuthkit.org/