Linux Acquisitions Made Easier – An Open-Source, Extensible Framework

For the common investigator, Windows acquisition is something we see and perform nearly daily, and we have our trusted set of tools to acquire and process specific triage artifacts. When provided with a Linux host, this methodology becomes trickier; there are dozens of artifacts scattered across the system, and not only is it a tedious process to extract this evidence from larger-scale systems, this process may be challenging for investigators inexperienced with Linux acquisition. Investigators need a tool that can accommodate the variability of artifact types, the high-speed demands of field investigations, and centralization of artifact reporting.