Skip to content

Linux forensic parsers and tools

Every parser and tool referenced on this site, with its licence and the artifacts it handles. Open an artifact for how to use it.

90 tools

ToolTypeArtifacts
Browser ForensicsIn browser
Disk Image ParserIn browser
Hash ExtractorIn browser
Linux Log ParserIn browser
PCAP ParserIn browser
RAM ParserIn browser
grep / zgrepGNU grep, gzipCLI · built into Linux
PlasoCLI · open source
journalctlsystemdCLI · built into Linux
VelociraptorPlatform · open source
findGNU findutilsCLI · built into Linux
rpmRPMCLI · built into Linux
statGNU coreutilsCLI · built into Linux
dpkgDebianCLI · built into Linux
UACCLI · open source
Volatility 3CLI · open source
ausearchLinux AuditCLI · built into Linux
systemctlsystemdCLI · built into Linux
debsumsDebianCLI · open source
debugfse2fsprogsCLI · built into Linux
jqCLI · open source
sqlite3SQLiteCLI · open source
aureportLinux AuditCLI · built into Linux
awkCLI · built into Linux
getfattrattrCLI · built into Linux
lnavCLI · open source
ssiproute2CLI · built into Linux
systemd-analyzesystemdCLI · built into Linux
The Sleuth KitCLI · open source
aa-statusAppArmorCLI · built into Linux
apport-unpackUbuntuCLI · built into Linux
audit2whySELinux policycoreutilsCLI · built into Linux
authselectRHEL / FedoraCLI · built into Linux
AVMLMicrosoftCLI · open source
bpftoolLinux kernel / libbpfCLI · open source
cloud-initCanonicalCLI · open source
container-explorerGoogleCLI · open source
coredumpctlsystemdCLI · built into Linux
crashCLI · open source
crictlKubernetesCLI · open source
ctrcontainerdCLI · open source
dmesgutil-linuxCLI · built into Linux
dockerDockerCLI · open source
dwarf2jsonCLI · open source
ExifToolCLI · open source
ext4magicCLI · open source
flatpakFlatpakCLI · built into Linux
gdbGNUCLI · open source
getcaplibcapCLI · built into Linux
getentglibcCLI · built into Linux
gioGLibCLI · built into Linux
GoAccessCLI · open source
HindsightCLI · open source
iptables-saveiptablesCLI · built into Linux
last / lastbutil-linuxCLI · built into Linux
libfsxfslibyalLibrary · open source
LiMECLI · open source
localsearchGNOMECLI · open source
logrotateCLI · built into Linux
lsofCLI · built into Linux
modinfokmodCLI · built into Linux
mysqlbinlogOracle MySQLCLI · open source
NeovimCLI · open source
nftnftablesCLI · built into Linux
nmcliNetworkManagerCLI · built into Linux
pgBadgerCLI · open source
php-malware-finderCLI · open source
psprocpsCLI · built into Linux
pwck / grpckshadow-utilsCLI · built into Linux
Python ElementTreePython standard libraryLibrary · open source
python-msgpackLibrary · open source
readelfGNU binutilsCLI · built into Linux
resolvectlsystemdCLI · built into Linux
sealertsetroubleshootCLI · built into Linux
semoduleSELinux policycoreutilsCLI · built into Linux
sestatusSELinux policycoreutilsCLI · built into Linux
snapCanonical snapdCLI · built into Linux
ssh-keygenOpenSSHCLI · built into Linux
stringsGNU binutilsCLI · built into Linux
sudoreplaysudoCLI · built into Linux
sysctlprocpsCLI · built into Linux
tinysparqlGNOMECLI · open source
trash-cliCLI · open source
udevadmsystemdCLI · built into Linux
utmpdumputil-linuxCLI · built into Linux
wtmpdbCLI · open source
xfs_dbxfsprogsCLI · built into Linux
xmllintlibxml2CLI · open source
YARAVirusTotalCLI · open source
ZircoliteCLI · open source