According to the CHFI v11 Operating System Forensics and Digital Evidence Analysis objectives, The Sleuth Kit (TSK) is a core open-source forensic framework used to analyze disk images and file systems , including NTFS, FAT, EXT, and others. TSK is designed as a modular toolkit , offering both command-line utilities (such as fsstat, fls, and istat) and a plug-in framework that enables structured, extensible analysis.
The fsstat tool is part of this framework and is used to extract file system metadata , including cluster size, inode structure, allocation status, and volume layout-key artifacts required for timeline reconstruction and anomaly detection. CHFI v11 emphasizes that investigators typically analyze disk images using TSK's plug- in-based architecture , which allows multiple forensic modules to operate consistently on the same evidence source without altering it. This architecture is also what enables higher-level forensic platforms (such as Autopsy) to integrate TSK seamlessly.
The other options are incorrect. TSK does not perform network scans , nor does it rely on unstructured manual inspection . While TSK provides APIs for developers, writing custom code is not required for standard disk image analysis and is not the primary method emphasized in CHFI v11.
Therefore, in alignment with CHFI v11, an investigator analyzes disk images using TSK through its plug-in framework , making Option C the correct answer.