This specialist-level course is for experienced forensic investigators who want to acquire the knowledge and skills to navigate, identify, capture and examine data from Linux-based systems.


Linux is an increasingly popular operating system. This two-day course will provide you with a practical understanding from a forensic perspective of how to deal with a Linux system, and requires no previous Linux knowledge. ​You will develop a core understanding of the file system data structures and key files so that they can be confident in capturing potential digital evidence. Throughout the course you will apply this knowledge in hands-on exercises to demonstrate and reinforce understanding, using both a Linux environment and Windows based forensic software.


Completion of the 7Safe CFIP course is highly recommended. Alternatively you will need an understanding of digital forensic principles and practices. No Linux experience is necessary.

Who Should Attend?

  • Forensic practitioners

  • Systems administrators

  • Cyber investigators who want to extend their experience from Window-based systems to the Linux environment.

Delegates will learn how to


Upon completion of the course you will have used a Linux System to:

  • Become familiar with both Linux GUI and command line environments.
  • Demonstrate how Linux can be used for forensic imaging.
  • Capture RAM and basic volatile data from a live Linux system. (Note: This is not network identification or network traffic capture)

and Windows based forensic software and an image of a Linux system to:

  • Examine ext3 and ext4 file system structures
  • Identify core system information
  • Explore system log files for artefacts including; boots, logins and device connection
  • Examine user artefacts including; recent activity, thumbnails and printing.


On this course, you will:

  • Understand the data structures associated with the ‘ext’ file systems
  • Learn effective techniques to extract data from a Linux environment
  • Develop confidence when identifying and capturing Linux system artefacts
  • Improve your ability to respond effectively to a wider range of forensic incidents



  1. What is Linux? Overview of flavours (distributions)
  2. Key differences between Linux and Windows forensics
  3. Linux concepts, privileges and permissions
  4. Linux disk layouts and key directories
  5. Navigating a Linux system and commonly used command line utilities
  6. Understanding devices and disk mounting
  7. Data collection from and using Linux systems
  8. Capturing volatile data including RAM
  9. Built-in forensic applications i.e dd for imaging and disk wiping
  10. Overview of file system compatibility, ext2, 3 and 4
  11. Ext file systems How disks are mapped and data stored
  12. Problems associated with recovering data from ext file systems
  13. System information from a forensic image
  14. Log files, where to find them and nature of content
  15. Devices connected and disks mounted
  16. User accounts – identification, passwords and permissions
  17. Introduction to memory analysis
  18. User system navigation, execution and printing
  19. Linux in Business - FTP servers, databases, mail, web-servers
  20. Capturing and process for log file examination using Linux