Linux Digital Forensics

root@forensic:~$ sudo forensics --methodology --tools --practice 

A practical knowledge base for investigating Linux systems. Learn the methodology of forensic analysis and how to use the tools — from acquisition and file carving to memory and timeline analysis.

New → Download Toolkit 4 Linux Install the whole forensic toolbox with one command: "curl -sS -k https://forensic4linux.com/download/toolkit | sh"  Get the toolkit

Forensic articles

Concepts and methodology every Linux examiner should know.

concepts

Introduction to Linux Forensics

Why Linux forensics matters, what evidence Linux systems produce, and the core principles of a sound investigation.

$ read 001
acquisition

Live vs. Dead Acquisition

When to collect from a running system and when to pull the plug. Trade-offs, risks, and order-of-volatility.

$ read 002
filesystem

Recovering Deleted Files on ext4

How ext4 deletes data, and using debugfs, extundelete, and carving to get files back.

$ read 003
logs

Log Analysis with journald & syslog

Where Linux keeps logs, how to query systemd's journal, and what to look for in a compromise.

$ read 004
memory

Memory Forensics with Volatility

Capturing RAM and profiling a Linux memory dump to find processes, open files, and injected code.

$ read 005
timeline

Timeline Analysis with The Sleuth Kit

Turning a raw disk image into a full timeline with fls and mactime to answer "when did it happen?".

$ read 006
artifacts

Where Evidence Hides: User & System Artifacts

A tour of the directories and files on a Linux box that hold the most forensic value.

$ read 007

Tool usage guides

Hands-on commands for the tools of the trade.

all-in-one

Download Toolkit 4 Linux

One command installs The Sleuth Kit, Autopsy, Volatility, dcfldd, foremost, testdisk and more — the whole toolbox.

$ curl .../toolkit | sh
tsk

The Sleuth Kit

fls, icat, istat, mmls, fsstat — file-system and volume analysis from images without mounting.

$ fls -r image.dd
gui

Autopsy

The graphical front-end to Sleuth Kit: case management, ingest modules, and reporting.

$ autopsy
memory

Volatility

Profiling and analyzing Linux memory dumps — processes, sockets, and kernel modules.

$ vol -f dump.lime linux.pslist
acquisition

Acquisition: dd & dcfldd

Imaging drives and memory with dd, and why dcfldd's hashing on the fly matters.

$ dd if=/dev/sda of=img.dd
carving

File Carving with foremost & scalpel

Pulling files out of unallocated space by signature, no filesystem required.

$ foremost -i img.dd -o out/
strings

strings & grep for Evidence

The first-pass tools of every forensic analyst: extracting and hunting text in binaries.

$ strings -el bin | grep -i flag
recovery

testdisk & photorec

Repairing partition tables and recovering lost partitions and media files.

$ testdisk /dev/sdb
data

bulk_extractor

High-speed scanning for emails, URLs, credit cards, and other "bulk" artifacts.

$ bulk_extractor -o out/ image.dd

Typical investigation flow

From sealed evidence to written report.

1

Identify
Preserve & image the evidence.

2

Collect
Live data, memory, artifacts.

3

Examine
Analyze the image and dumps.

4

Analyze
Correlate artifacts, timeline.

5

Report
Document findings, defend.