Linuxripper: an open-source Linux-based triage script for use in learning and teaching, and professional practice

This research presents linuxripper; an open-source data collection and digital forensic triage script for Linux-based systems. The script and this research are intended to serve as both a learning and teaching tool, and also as a useful resource for practitioners. As a learning and teaching tool, this work provides academics with resources and information to facilitate incorporating linuxripper into learning, teaching and assessment. And as a tool for use in professional practice, it provides investigators with a reference guide for the location of key files on Linux-based systems. This research also helps inexperienced practitioners and learners alike in parsing and understanding key Linux artefacts. As a reference for the experienced practitioner, linuxripper automates collection and parsing of relevant information from several key artefacts, which are of particular relevance in initial data and intelligence gathering during investigation of a crime or incident. Linuxripper leverages command line tools and software that are expected to be present in most (if not all) major Linux distributions, making it a flexible and adaptable tool; suitable for many distributions and investigative scenarios. It is hoped that, following publication of this research, the DFIR community will contribute improvements and the addition of new useful features, drawn from their own casework experience, so that the tool's capabilities continue to improve.