A practical knowledge base for investigating Linux systems. Learn the methodology of forensic analysis and how to use the tools — from acquisition and file carving to memory and timeline analysis.
"curl -sS -k https://forensic4linux.com/download/toolkit | sh"
Get the toolkit
Concepts and methodology every Linux examiner should know.
Why Linux forensics matters, what evidence Linux systems produce, and the core principles of a sound investigation.
When to collect from a running system and when to pull the plug. Trade-offs, risks, and order-of-volatility.
How ext4 deletes data, and using debugfs, extundelete, and carving to get files back.
Where Linux keeps logs, how to query systemd's journal, and what to look for in a compromise.
Capturing RAM and profiling a Linux memory dump to find processes, open files, and injected code.
Turning a raw disk image into a full timeline with fls and mactime to answer "when did it happen?".
A tour of the directories and files on a Linux box that hold the most forensic value.
Hands-on commands for the tools of the trade.
One command installs The Sleuth Kit, Autopsy, Volatility, dcfldd, foremost, testdisk and more — the whole toolbox.
fls, icat, istat, mmls, fsstat — file-system and volume analysis from images without mounting.
Profiling and analyzing Linux memory dumps — processes, sockets, and kernel modules.
Imaging drives and memory with dd, and why dcfldd's hashing on the fly matters.
Pulling files out of unallocated space by signature, no filesystem required.
The first-pass tools of every forensic analyst: extracting and hunting text in binaries.
Repairing partition tables and recovering lost partitions and media files.
From sealed evidence to written report.
Identify
Preserve & image the evidence.
Collect
Live data, memory, artifacts.
Examine
Analyze the image and dumps.
Analyze
Correlate artifacts, timeline.
Report
Document findings, defend.