Linux Evidence Acquisition Framework
-
Updated
Sep 30, 2024 - Python
#
linux-forensics
Here are 36 public repositories matching this topic...
Hello, world! 🌍 I'm a passionate Linux System & Server Administrator, living in front of three tty terminals 🖥 🖥 🖥, where I breathe Linux and script bash every day. With a burning desire to master the command line, I dive deep into the file system. As a content creator on YouTube, I share my journey and knowledge with fellow linux enthusiasts!
android linux bash docker osint ubuntu hacking kali-linux bash-scripting mullvad linux-forensics alfa-adapters
-
Updated
Jun 12, 2026
Hands-on projects for beginners to learn and practice Linux forensics and essential cybersecurity skills
-
Updated
Jun 29, 2024
Unified digital forensics platform bringing disk, RAM, logical acquisition, and backup analysis together for Windows, Linux, Android, and iOS.
android windows ios forensics forensic-analysis forensic forensic-tools forensics-tools linux-forensics digitalforensic ios-forensics android-forensics forensic-tool android-forensics-tool forensic-imageing iphone-forensic
-
Updated
Aug 12, 2026 - Rust
Tools and Techniques for Digital Forensics and Incident Response
incident-response dfir digital-forensics digital-forensics-incident-response windows-forensics linux-forensics
-
Updated
Feb 16, 2026
Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.
rust timeline incident-response forensics dfir ntfs digital-forensics sigma yara memory-forensics threat-intelligence mitre-attack evtx browser-forensics velociraptor duckdb windows-forensics disk-forensics linux-forensics attack-flow
-
Updated
Aug 9, 2026 - Rust
A comprehensive repository for CyberOps documentation, Blue Team playbooks, and open-source forensic tools like Cerberus and Chimera.
powershell incident-response forensics dfir cybersecurity threat-hunting digital-forensics triage blueteam memory-forensics security-tools threat-detection live-response windows-forensics memory-acquisition linux-forensics kusto-query incident-response-tool
-
Updated
Jan 21, 2026
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
rust incident-response dfir threat-hunting malware-analysis digital-forensics memory-analysis yara volatility lime ld-preload memory-forensics dpapi windows-forensics linux-forensics avml rootkit-detection ioc-detection elf-analysis
-
Updated
Aug 9, 2026 - Rust
Hello, world! 🌍 I'm a passionate Linux System & Server Administrator, living in front of three tty terminals 🖥 🖥 🖥, where I breathe Linux and script bash every day. With a burning desire to master the command line, I dive deep into the file system. As a content creator on YouTube, I share my journey and knowledge with fellow linux enthusiasts!
android linux bash docker osint ubuntu hacking kali-linux bash-scripting mullvad linux-forensics alfa-adapters
-
Updated
Apr 4, 2025
Useful tools for (not only) digital forensics
network-forensics incident-response digital-forensics memory-forensics mobile-forensics windows-forensics linux-forensics macos-forensics ios-forensics live-forensics android-forensics mobile-forensic webbrowsers-forensics
-
Updated
Jul 21, 2026
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
rust persistence incident-response forensics dfir threat-hunting digital-forensics sigma soc yara triage memory-forensics mitre-attack lolbins kape velociraptor windows-forensics linux-forensics macos-forensics forensic-artifacts
-
Updated
Aug 12, 2026 - Rust
Practical labs, case studies, and investigation notes for CHFI v11 — covering digital forensics, malware forensics, incident response, evidence collection, and analysis tools.
network-forensics data-acquisition digital-forensics computer-forensics memory-forensics mobile-forensics evidence-collection windows-forensics disk-forensics cyber-forensics linux-forensics malware-forensics chfi cyber-investigation cybercrime-investigation log-anaysis forensics-analysis
-
Updated
Aug 31, 2025
Home lab for Linux endpoint forensics using GRR Rapid Response, covering server setup, agent deployment, live forensics, memory analysis, and persistence detection.
-
Updated
Jul 24, 2024
Linux Forensics Guide
-
Updated
Jun 14, 2025 - HTML
A collection of digital forensics lab reports covering Linux artifact recovery, shell history analysis, bash script forensics, and incident reconstruction using tools like SleuthKit, Auditd, and command-line utilities.
cron incident-response steganalysis auditd digital-forensics e3 forensic-analysis shell-history sleuthkit mactime timeline-analysis ftk-imager mobile-forensics linux-forensics bash-artifacts
-
Updated
Jun 18, 2025
Understanding what forensic artifacts are present in the Windows and Linux Operating Systems, how to collect them, and leverage them to investigate security incidents.
dfir malware-analysis volatility memory-forensics redline thehive-project kape velociraptor tryhackme windows-forensics tryhackme-writeups linux-forensics tryhackme-answers autopsy-gui registry-forensics registry-explorer
-
Updated
Nov 7, 2025
Linux log forensics investigation focused on SSH brute-force detection, persistence analysis, privilege escalation, and attack timeline reconstruction.
-
Updated
Aug 12, 2026
Complete notes, lab writeups, and challenge walkthroughs for the LetsDefend Incident Responder Path. This covers DFIR, memory forensics, Windows Event Log analysis, Active Directory attack hunting, malware triage and more!
log-analysis incident-response active-directory dfir sysmon malware-analysis volatility memory-forensics kerberoasting browser-forensics windows-forensics linux-forensics soc-analyst letsdefend forensic-aquisition
-
Updated
Aug 11, 2026
Linux Forensic Collector, Quick & Thorough.
-
Updated
Jun 26, 2025 - Shell
SLeek is an interactive Linux threat-hunting script that guides an analyst through a structured, command-line examination of a system for signs of malware and compromise.
-
Updated
Dec 13, 2025 - Shell
Improve this page
Add a description, image, and links to the linux-forensics topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the linux-forensics topic, visit your repo's landing page and select "manage topics."