Linux Evidence Acquisition Framework
-
Updated
Sep 30, 2024 - Python
#
linux-forensics
Here are 30 public repositories matching this topic...
Hello, world! 🌍 I'm a passionate Linux System & Server Administrator, living in front of three tty terminals 🖥 🖥 🖥, where I breathe Linux and script bash every day. With a burning desire to master the command line, I dive deep into the file system. As a content creator on YouTube, I share my journey and knowledge with fellow linux enthusiasts!
android linux bash docker osint ubuntu hacking kali-linux bash-scripting mullvad linux-forensics alfa-adapters
-
Updated
Jun 12, 2026
Hands-on projects for beginners to learn and practice Linux forensics and essential cybersecurity skills
-
Updated
Jun 29, 2024
Tools and Techniques for Digital Forensics and Incident Response
incident-response dfir digital-forensics digital-forensics-incident-response windows-forensics linux-forensics
-
Updated
Feb 16, 2026
A comprehensive repository for CyberOps documentation, Blue Team playbooks, and open-source forensic tools like Cerberus and Chimera.
powershell incident-response forensics dfir cybersecurity threat-hunting digital-forensics triage blueteam memory-forensics security-tools threat-detection live-response windows-forensics memory-acquisition linux-forensics kusto-query incident-response-tool
-
Updated
Jan 21, 2026
Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.
rust timeline incident-response forensics dfir ntfs digital-forensics sigma yara memory-forensics threat-intelligence mitre-attack evtx browser-forensics velociraptor duckdb windows-forensics disk-forensics linux-forensics attack-flow
-
Updated
Jun 27, 2026 - Rust
Hello, world! 🌍 I'm a passionate Linux System & Server Administrator, living in front of three tty terminals 🖥 🖥 🖥, where I breathe Linux and script bash every day. With a burning desire to master the command line, I dive deep into the file system. As a content creator on YouTube, I share my journey and knowledge with fellow linux enthusiasts!
android linux bash docker osint ubuntu hacking kali-linux bash-scripting mullvad linux-forensics alfa-adapters
-
Updated
Apr 4, 2025
Home lab for Linux endpoint forensics using GRR Rapid Response, covering server setup, agent deployment, live forensics, memory analysis, and persistence detection.
-
Updated
Jul 24, 2024
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
rust persistence incident-response forensics dfir threat-hunting digital-forensics sigma soc yara triage memory-forensics mitre-attack lolbins kape velociraptor windows-forensics linux-forensics macos-forensics forensic-artifacts
-
Updated
Jun 27, 2026 - Rust
Linux Forensics Guide
-
Updated
Jun 14, 2025 - HTML
Useful tools for (not only) digital forensics
network-forensics incident-response digital-forensics memory-forensics mobile-forensics windows-forensics linux-forensics macos-forensics ios-forensics live-forensics android-forensics mobile-forensic webbrowsers-forensics
-
Updated
Jun 12, 2026
A collection of digital forensics lab reports covering Linux artifact recovery, shell history analysis, bash script forensics, and incident reconstruction using tools like SleuthKit, Auditd, and command-line utilities.
cron incident-response steganalysis auditd digital-forensics e3 forensic-analysis shell-history sleuthkit mactime timeline-analysis ftk-imager mobile-forensics linux-forensics bash-artifacts
-
Updated
Jun 18, 2025
Understanding what forensic artifacts are present in the Windows and Linux Operating Systems, how to collect them, and leverage them to investigate security incidents.
dfir malware-analysis volatility memory-forensics redline thehive-project kape velociraptor tryhackme windows-forensics tryhackme-writeups linux-forensics tryhackme-answers autopsy-gui registry-forensics registry-explorer
-
Updated
Nov 7, 2025
Modular, agent-less forensic triage framework for rapid Windows & Linux artifact collection and memory acquisition
powershell incident-response forensics dfir cybersecurity digital-forensics triage blueteam memory-forensics security-tools live-response windows-forensics memory-acquisition linux-forensics ir-toolkit aritfact-collection
-
Updated
Jan 8, 2026 - PowerShell
Linux Forensic Collector, Quick & Thorough.
-
Updated
Jun 26, 2025 - Shell
SLeek is an interactive Linux threat-hunting script that guides an analyst through a structured, command-line examination of a system for signs of malware and compromise.
-
Updated
Dec 13, 2025 - Shell
Practical labs, case studies, and investigation notes for CHFI v11 — covering digital forensics, malware forensics, incident response, evidence collection, and analysis tools.
network-forensics data-acquisition digital-forensics computer-forensics memory-forensics mobile-forensics evidence-collection windows-forensics disk-forensics cyber-forensics linux-forensics malware-forensics chfi cyber-investigation cybercrime-investigation log-anaysis forensics-analysis
-
Updated
Aug 31, 2025
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
rust incident-response dfir threat-hunting malware-analysis digital-forensics memory-analysis yara volatility lime ld-preload memory-forensics dpapi windows-forensics linux-forensics avml rootkit-detection ioc-detection elf-analysis
-
Updated
Jun 25, 2026 - Rust
Hands-on cybersecurity investigations including malware analysis, Windows and Linux forensics, disk image analysis, TLS traffic inspection, and file recovery.
-
Updated
Mar 6, 2026
Home lab for Linux endpoint forensics using GRR Rapid Response, covering server setup, agent deployment, live forensics, memory analysis, and persistence detection.
-
Updated
Jan 4, 2026
Improve this page
Add a description, image, and links to the linux-forensics topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the linux-forensics topic, visit your repo's landing page and select "manage topics."