About forensic4linux.com

forensic4linux.com is a knowledge base for digital forensics on Linux systems. It collects practical articles on investigation methodology and hands-on guides for the open source tools examiners actually use — from acquisition and file carving to memory and timeline analysis.

What you'll find here

• Articles on concepts: acquisition strategy, filesystem recovery, log analysis, memory forensics, timelining, and where evidence hides.
• Tool guides with real command lines: The Sleuth Kit, Autopsy, Volatility, dd/dcfldd, foremost & scalpel, strings & grep, testdisk & photorec, bulk_extractor.

Intended audience

Incident responders, security analysts, students, and CTF players who want a single, focused reference for Linux forensics. The tone is practical: commands first, theory where it explains the "why".

Methodology principles

Everything on this site follows a few core rules:

1. Preserve evidence — analyze images, never the original.
2. Verify integrity — hash at every step.
3. Document everything — commands, outputs, decisions.
4. Collect volatile data first — memory before disk.
5. Correlate — logs + filesystem + memory tell the story together.

Resources & references

Practice box setup? Spin up a VM, install any Linux distro, add the tools above with apt/dnf, make mistakes, and investigate them. That's the whole curriculum.

← Back to home