Tink vs The Sleuth Kit
The Sleuth Kit recovers files with fls, icat, and tsk_recover. That is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
The Sleuth Kit carves the image. Tink answers “why is this VPS sick?”
Accidental sysadmins land on The Sleuth Kit because a forensics CLI looks cheaper than a NAS. Then the host volume fills, nginx dies, and fls still looks complete — no inode match for host fill. A filling /var is a Tink warning; it is not a Sleuth Kit job unless you scraped recover output and watched it.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using The Sleuth Kit if you already run disk forensics. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | The Sleuth Kit |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Hours — image the disk, run mmls, fsstat, fls -rd, icat inodes, tsk_recover -a, then a host that still has no mechanic after the last recovered tree finished |
| What you get | Working monitoring, diagnosis, and approved fixes | A forensics CLI. Disk fill, nginx, Postgres, and certs stay your problem until you SSH past the last icat inode |
| Pricing | Free (Scout) / $9 / $29 per machine per month | CPL/IBM Open Source. You still pay the person who owns the VPS after the last tsk_recover looks finished |
| Hidden costs | None — fully managed | A quiet recovered-files tree that is not host fill, downtime to image the disk, inode homework, and a second tool to tell you the box is sick while the last fls still showed complete |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | mmls, fsstat, fls -rd, icat, tsk_recover -a. The Sleuth Kit does not watch a quiet cert or host auth.log after the last recover session ended |
| Configuration | None after install — heuristics and AI | Which image or /dev to open, -o offset, -f fstype, deleted vs allocated, destination dir, and which failed tsk_recover session actually pages you |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | You read the fls listing and recovered files, then SSH into the host to change the Linux box The Sleuth Kit already carved files off |
| Fix execution | Proposes and executes approved commands with an audit trail | Carve inodes from a volume — tsk_recover cannot free host disk, rotate a cert, or stop SSH brute-force unless you run fls again |
| Alerting | Built-in across 8 channels | Not a Sleuth Kit job — cron mail from a failed recover plus a separate monitoring tool have to fire |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Not a Sleuth Kit job — a recovered inode date does not forecast a quiet host filling up |
| SSH brute-force detection | Built-in — parses auth.log every scan | Never — The Sleuth Kit does not read host auth.log, journald, or firewall state after the last recover session ended |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | Silence if the host dies after the last tsk_recover -a — unless you built a separate uptime check |
| Public status page | Shareable URL with 90-day history | None — The Sleuth Kit has no customer-facing status page for the Linux host |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | None — a recovered-inode recap is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire failed tsk_recover restores into PagerDuty or another incident tool |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | fls, icat, tsk_recover, and SSH. No mechanic you text when /var filled and the last fls still showed complete |
| Learning curve | None — works after install | Steep — mmls offsets, -f fstype, fls -rd vs icat, tsk_recover -a, and which failure is the carve vs the running host |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Teams that already run The Sleuth Kit for disk forensics, not a sick-VPS mechanic |
When The Sleuth Kit is the right choice
Keep using The Sleuth Kit when you already want that exact job:
- Disk forensics — you need mmls, fls, icat, and tsk_recover, not a mechanic.
- An existing evidence image — allocated vs deleted inodes matter more than guest nginx, certs, and SSH on a quiet VPS.
- An existing lab or nested setup — Autopsy already runs, the image already exists, and someone owns the case.
- Hosts that only page on recover or carve death — you already run a forensics pipeline, not a sick-box SSH loop.
The real cost of “just watch tsk_recover”
The Sleuth Kit carves a volume. A working ops loop for five Linux boxes is not:
- A healthy recover still means you SSH into the host and change the box by hand when it gets sick later
- Host fill, nginx, certs, and SSH brute-force never appear unless a separate tool scraped those signals and a rule fired
- A filling /var is a Tink disk warning on every scan — tsk_recover will stay quiet until the next image
- A single VPS with a dead agent still needs a mechanic, not another inode listing
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who keeps failed-recover notifications alive after a green tsk_recover session, and every scan includes a diagnosis a quiet recovered-inode tree will not type.
No fls listing or inode homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs PhotoRec · Tink vs TestDisk · Tink vs Foremost