Practical Linux Forensics: A Guide for Digital Investigators
Bruce Nikkel · No Starch Press · 2021
Identifier: ISBN 978-1-7185-0196-6
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Postmortem analysis of Linux systems from the operating system's own structures outward: partition tables and LVM, Linux file systems, directory layout, the systemd journal and other logs, boot reconstruction, installed packages, network configuration, time and locale, login sessions, desktop artifacts, and traces of attached peripherals.
Who it is for, and when
The current reference for Linux examination, and the right book when the subject system is a server. It is deliberately tool-agnostic, which means the findings you take from it are reproducible with whatever you have, and explicable without reference to a vendor's parser. One chapter, on Linux logs, is a free download from the publisher.
What it does not cover
Postmortem only — acquisition is left to the author's other book. Light on containers and immutable or atomic distributions, and on Btrfs-heavy deployments, all of which have grown since 2021. No Android, despite the shared kernel.
Go to the source
Open at nostarch.com (opens in a new tab)https://nostarch.com/practical-linux-forensics
Details
- Type
- Book
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Bruce Nikkel
- Publisher
- No Starch Press
- Year
- 2021
- Identifier
- ISBN 978-1-7185-0196-6
- Topics
- linux, log-analysis, file-systems, timeline
- Checked at source
Related entries
mac4n6
FreeA macOS and iOS forensic research blog, authored under the handle @iamevltwin with occasional contributors, covering Apple artifacts, analysis tooling and conference presentations.
A set of eleven numbered DFIR challenges plus additional memory forensics, unallocated-space and Linux cases published by Ali Hadi, each with the scenario and the evidence to work it. Subjects include a breached web server with both disk image and memory dump, Windows user policy violation, alternate data streams, NTFS hidden-file recovery, browser artefacts, a Sysinternals-abuse malware case, encryption, and anti-forensics and data hiding.
Autopsy
FreeAn open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.