Name & Direct Link: Investigating Linux Devices

Certification Information: Certifications and Digital Badges

Platform: 13Cubed

Cost: $895

Exam Type: Hands-On/Multiple Choice

Topics Covered:

• Introduction to Linux
• Linux Logs
• Linux File Systems
• Persistence Mechanisms
• Evidence Collection
• Timelining
• Linux Memory Forensics
• Live Response
• Analyzing a Compromised System

Name & Direct Link: Advanced Linux Detection and Forensics Cheatsheet

Name & Direct Link: Linux Forensics Training Videos

Platform: YouTube – 13Cubed

Topics: Linux Memory Forensics – Memory Capture and Analysis, First Look at usbrip

Name & Direct Link: Linux Forensics Training Videos

Platform: YouTube – BlueMonkey 4n6

Cost: Free

Topics: Linux Forensics Locations of Interest – Magnet Forensics Quick Reference Guide, Linux Memory Forensics, Linux Command Line Tutorial for Forensics

Name & Direct Link: Linux Attack and Live Forensics at Scale

Platform: Defensive Security

Cost: $449

Hands-On: Yes

Certificate of Completion: Yes

Topics: SIEM, HELK, Splunk, Graylog, Wazuh, Syslog, Auditd, Falco, Tracee, Sysdig, Velociraptor, OSQuery, Sandfly, Sysmon4Linux, CatScale, rkhunter, UAC, Yara Scanning, SELinux, Clamav, Zeek, Suricata, Arkime Full Packet Capture, Forward Proxy Squid SSL Decryption, WAF Modsecurity, Threat Hunting vs Incident Response, Linux MITRE ATT&CK, Linux EDR/Security Products, DFIR Basics, DFIR Preparation, TCP/IP Stack, Basic Linux Investigation Tools, General Rootkits Behavior, Baseline Profiling, Rule-Based Linux Log Analysis, Elastic, Sigma, Linux Memory Forensics, Volatility, C2Frameworks, Tunnels, Pivots, Redirectors, Incident Response, IRIS Introduction, IR Playbooks, Linux ATTACK/Detection Analysis,

Name & Direct Link: Linux Forensics Training Videos

Platform: YouTube – DFIRScience

Good for Beginners: Yes

Topics: Linux Forensics CTF Walkthrough, Forensic Memory Acquisition in Linux – LiME, Digital Forensics in Linux

Name & Direct Link: Linux Forensics Courses

Platform: Cyber 5W

Cost (On-Demand Courses): Free – $650

Good for Beginners: Yes

Hands-On Component: Some courses have hands-on labs (each course indicates “theory” and/or “hands-on”)

Proof of Completion: Yes – Certificate

Student Discount: Students get 25% off when registering with their college or university email account and contacting Cyber5W

Topics: Linux Forensics, Evidence Acquisition, DD Command, Imaging Disks Using DD, Disk Wiping and Initialization, E01 Images, ewfverify, Ewfacquire, Ewfinfo, Creating a Bootable USB Drive Using DDRESCUE Tool, Using NETCAT, Linux Forensics Distributions, Intro to Linux from a Forensics Perspective, Tsurugi, Ubuntu

Community/Forums: There are forums on the Cyber5W site where you can ask questions.

Book Title: Practical Linux Forensics: A Guide for Digital Investigators

Author: Bruce Nikkel

Publisher: No Starch Press

Where to Buy (links):

No Starch Press (Print & eBook)

Amazon* 

Topics: Digital Forensics Overview, Linux Overview, Evidence from Storage Devices and Filesystems, Directory Layout and Forensic Analysis of Linux Files, Investigating Evidence from Linux Logs, Reconstructing System Boot and Initialization, Examination of Installed Software Packages, Identifying Network Configuration Artifacts, Forensic Analysis of Time and Location, Reconstructing User Desktops and Login Activity, Forensic Traces of Attached Peripheral Devices

*As an Amazon associate, I earn from qualifying purchases. This helps with the cost of running this website.

Name & Affiliate Link*: Linux Forensics

Platform: INE

Price: $749/Year (Includes access to all courses in INE)

Linux Forensics Topics: Netcat, Scripts, Memory Acquisition, Compiling LiME, Dumping RAM with LiME, MBR Basics, Extended Partitions, GUID Partitions, Building a Timeline as a CSV, Extracting User Bash History Files, Extracting System Logs, EXT Filesystem Basics, Filesystem Analysis, Python, Memory Analysis, Volatility, Malware, Packet Captures, Obfuscation

*DFIR Diva is a partner of INE and receives a small percentage of sales made through partner links that go toward the cost of keeping this site running.

Name & Direct Link: BlackPerl

Platform: YouTube – BlackPerl

For Beginners: Yes

Topics: Incident Response, Threat Hunting, Automation, SIEM, Threat Intelligence, Log Analysis, OSQuery, Binalyze, Autopsy, PDF Analysis, Email Header Analysis, Regex, AWS, Cloud, QRadar, MITRE ATT&CK, Phishing, Windows Forensics, Memory Forensics, Volatility, Malicious Scripts, YARA

Playlists:

• Incident Response Training – Full Course
• DFIR Tools and Techniques
• Malware Analysis
• Learn SIEM With Me
• Live Incident Response
• Linux Forensics