The forensic4linux.com Toolkit is a single shell script that downloads and
installs the most commonly used open-source Linux forensic tools — acquisition, carving,
recovery, logs, memory, and metadata analysis — through your distribution's package manager
and pip. It is written in portable POSIX sh, detects your distribution
automatically, and installs every tool with sensible defaults.
On a machine where your user has sudo rights, that's all you need — the script
re-uses sudo for the package commands and asks for the password when required. To be explicit
about privileges you can also run:
curl -sS -k https://forensic4linux.com/download/toolkit | sudo shsh means you run code from the network as your user (or root).
The script is plain text and logged to /tmp/forensic4linux-toolkit.log It only installs packages from your distro's repositories and volatility3 from
PyPI; it never touches your data.
| Tool | Purpose | Provides |
|---|---|---|
| The Sleuth Kit | File-system & volume analysis from images | fls, icat, istat, mmls, fsstat, mactime |
| Autopsy | Graphical forensics platform on top of TSK | autopsy |
| dcfldd | Drive imaging with on-the-fly hashing | dcfldd |
| testdisk / photorec | Partition recovery & media carving | testdisk, photorec |
| foremost | Signature-based file carving | foremost |
| scalpel | Fast, config-driven file carving | scalpel |
| bulk_extractor | Bulk artifact extraction (emails, URLs, PII) | bulk_extractor |
| extundelete | Deleted-file recovery on ext3/ext4 | extundelete |
| ddrescue | Robust drive imaging past read errors | ddrescue |
| e2fsprogs | ext filesystem internals & debugfs | debugfs |
| binutils | Text extraction from binaries | strings |
| ripgrep | Fast grep for logs & raw image searching | rg |
| libewf tools | E01 / EWF expert-witness format imaging | ewfacquire, ewfexport |
| p7zip / unzip | Archive handling | 7z, unzip |
| exiftool | Metadata extraction from media | exiftool |
| smartmontools | Drive health inspection | smartctl |
| hdparm | Drive identity & info | hdparm |
| volatility3 | Memory forensics (from PyPI) | vol3 |
| Family | Package manager | Coverage |
|---|---|---|
| Debian / Ubuntu | apt | Full — everything is packaged |
| Fedora / RHEL / CentOS / Rocky / Alma | dnf (yum fallback) | Full — most tools packaged |
| Arch Linux | pacman | Good — some tools live in the AUR and are skipped with a warning |
| openSUSE | zypper | Good — most tools packaged |
| Alpine | apk | Partial — core tools only |
If a tool isn't available in your distribution's repositories, the script reports it in the final summary instead of failing — every tool that can be installed, is.
/etc/os-release.sudo./tmp/forensic4linux-toolkit.log.