Linux

If you have not used Linux, getting started takes a little extra work — but there is plenty of help online and most things are easier than they look. Linux is free and open source, needs fewer resources than Windows, and can breathe life into an old PC.

Strictly speaking, "Linux" is just the kernel — the core that talks to your hardware. What you actually install is a distribution (a "distro"): the kernel plus a desktop, a package manager and a curated set of software, assembled by a community or company. That is why Ubuntu, Debian and Mint can all be "Linux" yet look and feel different.

For a digital investigator, Linux is not just a cheaper Windows. It changes how you can work with evidence:

You can do forensics on any distro, but several are pre-built with the tooling already in place:

Linux ships many distributions differing in look and installed software (called packages). Package management differs per distro — RPM (Red Hat Package Manager) and DPKG (Debian) are the two main families. The course uses Debian-based Linux (Ubuntu, Linux Mint, Debian, REMnux).

A package is a bundle of software plus a description of everything it needs to run (its dependencies). A package manager installs that bundle, pulls in the dependencies automatically, and keeps track of what is on the system so you can update or remove it cleanly. No hunting for installers, no leftover files — this is one of the quiet pleasures of Linux.

On the Debian-based systems used here, apt is the command you will reach for daily. The typical workflow:

$ sudo apt update          # refresh the list of available packages
$ sudo apt upgrade         # install updates for what you already have
$ sudo apt install yara    # install a package (and its dependencies)
$ apt search sleuthkit     # find a package by keyword
$ apt show sleuthkit       # read the description before installing
$ sudo apt remove yara     # uninstall, keeping config files
$ sudo apt purge yara      # uninstall and remove config too

A starter set you will likely want on an analysis machine:

$ sudo apt install sleuthkit yara clamav-daemon \
      wireshark tshark binwalk foremost exiftool \
      net-tools curl jq

The terminal — the Command Line Interface (CLI) — is where Linux shows its power, and for many it is a learning curve: new commands, flags and ways of working in a text box.

lablo@linuxserver:~$ sudo apt-get update

That prompt tells you more than it looks. Read it left to right:

Almost every command follows the same shape: the command, some options (flags), and one or more arguments.

$ ls -lah /var/log
  │   │    └── argument  (what to act on)
  │   └─────── options   (how to behave: long, all, human-readable)
  └─────────── command   (what to run)

Linux protects system areas behind the root account. sudo ("superuser do") runs a single command with elevated rights — far safer than logging in as root permanently. If a command fails with Permission denied, that is usually the system telling you to think before you reach for sudo.

This is the idea that makes Linux a multitool. Every command produces text, and you can feed one command's output straight into the next. Small, single-purpose tools combine into something far larger than any one of them.

$ cat access.log | grep "POST" | awk '{print $1}' | sort | uniq -c | sort -rn

Unlike Windows' drive letters, Linux has a single tree starting at / (the root). Knowing where things live is half of any investigation — logs, configs and running-process data all have a home.

Navigation is quick once the verbs are muscle memory:

$ pwd                 # where am I?
$ ls -lah             # list everything, with detail and sizes
$ cd /var/log         # change directory
$ cd ..               # up one level
$ cd ~                # back to home

A small set of commands covers most investigative needs. Learn these and you can read logs, find files, follow processes and verify evidence — the everyday motions of an examiner.

find walks the filesystem and filters on almost any property — name, age, size, permissions. It is the workhorse for locating artifacts in a mounted image.

$ find / -name "*.php" -mtime -1 2>/dev/null
$ find /tmp -perm -4000 -type f          # SUID files — classic privesc check
$ find /home -name "id_rsa" 2>/dev/null  # SSH private keys left behind
$ find / -newermt "2026-06-23" -type f 2>/dev/null

$ ps aux --sort=-%cpu        # all processes, hungriest first
$ ss -tulpn                  # listening ports + owning process
$ lsof -p 1337               # files and sockets a process has open
$ ss -tn state established   # active connections right now

Logs are just text, and Linux is exceptional at text. Four small tools — grep, awk, cut, sort/uniq — answer most "who, what, how many" questions you will ask of a log.

# Top 10 IPs hitting a web server
$ awk '{print $1}' access.log | sort | uniq -c | sort -rn | head

# Failed SSH logins, with the offending IP
$ grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn

# How many 404s today
$ grep " 404 " access.log | wc -l

# Pull the 4th column (a field) from a colon-delimited file
$ cut -d: -f4 /etc/passwd

When you have an unknown file — a suspicious download, a carved fragment, a sample from an alert — a few commands tell you what it is and let you record it defensibly before you do anything else.

$ file invoice.pdf.exe
invoice.pdf.exe: PE32 executable (GUI) Intel 80386, for MS Windows

$ strings -n 8 invoice.pdf.exe | grep -iE "http|\.exe|cmd|powershell"
$ sha256sum invoice.pdf.exe
$ stat invoice.pdf.exe

Hashing is not only for malware — it is how you prove a copy is identical to the source. Hash before and after any handling and the values must match.

$ sha256sum evidence.img > evidence.img.sha256   # record at acquisition
$ sha256sum -c evidence.img.sha256               # verify later: OK or FAILED

This page is a foundation. Two companion references go deeper.