Legal Cyber Academy
BookPaidCurrent

Practical Linux Forensics: A Guide for Digital Investigators

Bruce Nikkel · No Starch Press · 2021

Identifier: ISBN 978-1-7185-0196-6

Access and status

Cost

Paid

Costs money to buy outright — a book, a licence, a registration.

Status

Current

Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.

What it is

Postmortem analysis of Linux systems from the operating system's own structures outward: partition tables and LVM, Linux file systems, directory layout, the systemd journal and other logs, boot reconstruction, installed packages, network configuration, time and locale, login sessions, desktop artifacts, and traces of attached peripherals.

Who it is for, and when

The current reference for Linux examination, and the right book when the subject system is a server. It is deliberately tool-agnostic, which means the findings you take from it are reproducible with whatever you have, and explicable without reference to a vendor's parser. One chapter, on Linux logs, is a free download from the publisher.

What it does not cover

Postmortem only — acquisition is left to the author's other book. Light on containers and immutable or atomic distributions, and on Btrfs-heavy deployments, all of which have grown since 2021. No Android, despite the shared kernel.

Go to the source

Open at nostarch.com (opens in a new tab)

https://nostarch.com/practical-linux-forensics

Details

Type
Book
Written for
Working examinerAdvancedWorking examiner, Advanced
Author
Bruce Nikkel
Publisher
No Starch Press
Year
2021
Identifier
ISBN 978-1-7185-0196-6
Topics
linux, log-analysis, file-systems, timeline
Checked at source
  • mac4n6

    Free

    A macOS and iOS forensic research blog, authored under the handle @iamevltwin with occasional contributors, covering Apple artifacts, analysis tooling and conference presentations.

  • A set of eleven numbered DFIR challenges plus additional memory forensics, unallocated-space and Linux cases published by Ali Hadi, each with the scenario and the evidence to work it. Subjects include a breached web server with both disk image and memory dump, Windows user policy violation, alternate data streams, NTFS hidden-file recovery, browser artefacts, a Sysinternals-abuse malware case, encryption, and anti-forensics and data hiding.

  • An open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.

  • A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.

  • David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.