Linux forensic parsers and tools

Every parser and tool referenced on this site, with its licence and the artifacts it handles. Open an artifact for how to use it.

90 tools

Tool	Type	Artifacts
Browser Forensics	In browser	Browser Profiles on Linux
Disk Image Parser	In browser	ext4 Timestamps, crtime and Deleted Files XFS Forensics
Hash Extractor	In browser	SSH Artifacts
Linux Log Parser	In browser	auditd audit.log auth.log, secure and syslog Linux Firewall Logs SSH Artifacts sudo Logs systemd Journal wtmp, btmp, utmp and lastlog
PCAP Parser	In browser	Linux Firewall Logs
RAM Parser	In browser	Linux Kernel Modules Linux Memory Acquisition Shell History
grep / zgrepGNU grep, gzip	CLI · built into Linux	/etc/hosts, nsswitch.conf and resolv.conf on Linux Apache and Nginx Logs AppArmor and SELinux Denials auth.log, secure and syslog cloud-init Logs and Instance Data Cron, Anacron, at and systemd Timers dmesg, kern.log and the Kernel Ring Buffer on Linux dpkg, APT, RPM and DNF Logs Linux Firewall Logs logrotate State and Log Gaps MySQL, MariaDB and PostgreSQL Logs NetworkManager Profiles and State PAM Configuration and Modules rc.local, SysV init.d and MOTD Scripts SSH Artifacts sudo Logs sysctl, Boot Parameters and binfmt_misc on Linux udev and USB Device History on Linux Web Shells in the Web Root XDG Autostart .desktop Entries
Plaso	CLI · open source	Apache and Nginx Logs auditd audit.log auth.log, secure and syslog Browser Profiles on Linux dpkg, APT, RPM and DNF Logs ext4 Timestamps, crtime and Deleted Files Linux Firewall Logs NetworkManager Profiles and State Shell History sudo Logs systemd Journal udev and USB Device History on Linux viminfo, ShaDa and lesshst wtmp, btmp, utmp and lastlog XFS Forensics
journalctlsystemd	CLI · built into Linux	/etc/hosts, nsswitch.conf and resolv.conf on Linux AppArmor and SELinux Denials cloud-init Logs and Instance Data dmesg, kern.log and the Kernel Ring Buffer on Linux Linux Firewall Logs logrotate State and Log Gaps MySQL, MariaDB and PostgreSQL Logs NetworkManager Profiles and State rc.local, SysV init.d and MOTD Scripts Snap and Flatpak Artifacts sudo Logs systemd Journal udev and USB Device History on Linux XDG Autostart .desktop Entries
Velociraptor	Platform · open source	/etc/ld.so.preload and LD_PRELOAD /etc/passwd, shadow and group /proc Live Artifacts /tmp, /var/tmp and /dev/shm Cron, Anacron, at and systemd Timers Linux Kernel Modules rc.local, SysV init.d and MOTD Scripts Shell History Shell Startup Files SSH Artifacts systemd Journal systemd Unit Files wtmp, btmp, utmp and lastlog
findGNU findutils	CLI · built into Linux	/tmp, /var/tmp and /dev/shm eBPF Programs and Pinned Maps Linux Thumbnail Cache Linux Trash logrotate State and Log Gaps PAM Configuration and Modules Snap and Flatpak Artifacts SUID, SGID and File Capabilities sysctl, Boot Parameters and binfmt_misc on Linux Web Shells in the Web Root XDG Autostart .desktop Entries
rpmRPM	CLI · built into Linux	/etc/hosts, nsswitch.conf and resolv.conf on Linux dpkg, APT, RPM and DNF Logs PAM Configuration and Modules Shell Startup Files SUID, SGID and File Capabilities sysctl, Boot Parameters and binfmt_misc on Linux Web Shells in the Web Root XDG Autostart .desktop Entries
statGNU coreutils	CLI · built into Linux	/tmp, /var/tmp and /dev/shm ext4 Timestamps, crtime and Deleted Files Linux Thumbnail Cache Linux Trash logrotate State and Log Gaps SUID, SGID and File Capabilities Web Shells in the Web Root XFS Forensics
dpkgDebian	CLI · built into Linux	/etc/hosts, nsswitch.conf and resolv.conf on Linux dpkg, APT, RPM and DNF Logs PAM Configuration and Modules SUID, SGID and File Capabilities sysctl, Boot Parameters and binfmt_misc on Linux Web Shells in the Web Root XDG Autostart .desktop Entries
UAC	CLI · open source	/etc/ld.so.preload and LD_PRELOAD Cron, Anacron, at and systemd Timers Linux Kernel Modules rc.local, SysV init.d and MOTD Scripts SSH Artifacts systemd Unit Files
Volatility 3	CLI · open source	/etc/ld.so.preload and LD_PRELOAD /proc Live Artifacts eBPF Programs and Pinned Maps Linux Kernel Modules Linux Memory Acquisition Shell History
ausearchLinux Audit	CLI · built into Linux	/etc/passwd, shadow and group AppArmor and SELinux Denials auditd audit.log eBPF Programs and Pinned Maps sudo Logs
systemctlsystemd	CLI · built into Linux	Cron, Anacron, at and systemd Timers logrotate State and Log Gaps systemd Unit Files XDG Autostart .desktop Entries
debsumsDebian	CLI · open source	PAM Configuration and Modules Shell Startup Files SUID, SGID and File Capabilities
debugfse2fsprogs	CLI · built into Linux	/etc/ld.so.preload and LD_PRELOAD /tmp, /var/tmp and /dev/shm ext4 Timestamps, crtime and Deleted Files
jq	CLI · open source	cloud-init Logs and Instance Data Docker, containerd and Podman Artifacts on Linux Hosts Snap and Flatpak Artifacts
sqlite3SQLite	CLI · open source	Browser Profiles on Linux dpkg, APT, RPM and DNF Logs Tracker / LocalSearch DB
aureportLinux Audit	CLI · built into Linux	AppArmor and SELinux Denials auditd audit.log
awk	CLI · built into Linux	/etc/passwd, shadow and group Apache and Nginx Logs
getfattrattr	CLI · built into Linux	Linux Crash Reports and Core Dumps SUID, SGID and File Capabilities
lnav	CLI · open source	Apache and Nginx Logs auth.log, secure and syslog
ssiproute2	CLI · built into Linux	/proc Live Artifacts eBPF Programs and Pinned Maps
systemd-analyzesystemd	CLI · built into Linux	sysctl, Boot Parameters and binfmt_misc on Linux systemd Unit Files
The Sleuth Kit	CLI · open source	/tmp, /var/tmp and /dev/shm ext4 Timestamps, crtime and Deleted Files
aa-statusAppArmor	CLI · built into Linux	AppArmor and SELinux Denials
apport-unpackUbuntu	CLI · built into Linux	Linux Crash Reports and Core Dumps
audit2whySELinux policycoreutils	CLI · built into Linux	AppArmor and SELinux Denials
authselectRHEL / Fedora	CLI · built into Linux	PAM Configuration and Modules
AVMLMicrosoft	CLI · open source	Linux Memory Acquisition
bpftoolLinux kernel / libbpf	CLI · open source	eBPF Programs and Pinned Maps
cloud-initCanonical	CLI · open source	cloud-init Logs and Instance Data
container-explorerGoogle	CLI · open source	Docker, containerd and Podman Artifacts on Linux Hosts
coredumpctlsystemd	CLI · built into Linux	Linux Crash Reports and Core Dumps
crash	CLI · open source	Linux Crash Reports and Core Dumps
crictlKubernetes	CLI · open source	Docker, containerd and Podman Artifacts on Linux Hosts
ctrcontainerd	CLI · open source	Docker, containerd and Podman Artifacts on Linux Hosts
dmesgutil-linux	CLI · built into Linux	dmesg, kern.log and the Kernel Ring Buffer on Linux
dockerDocker	CLI · open source	Docker, containerd and Podman Artifacts on Linux Hosts
dwarf2json	CLI · open source	Linux Memory Acquisition
ExifTool	CLI · open source	Linux Thumbnail Cache
ext4magic	CLI · open source	ext4 Timestamps, crtime and Deleted Files
flatpakFlatpak	CLI · built into Linux	Snap and Flatpak Artifacts
gdbGNU	CLI · open source	Linux Crash Reports and Core Dumps
getcaplibcap	CLI · built into Linux	SUID, SGID and File Capabilities
getentglibc	CLI · built into Linux	/etc/hosts, nsswitch.conf and resolv.conf on Linux
gioGLib	CLI · built into Linux	Linux Trash
GoAccess	CLI · open source	Apache and Nginx Logs
Hindsight	CLI · open source	Browser Profiles on Linux
iptables-saveiptables	CLI · built into Linux	Linux Firewall Logs
last / lastbutil-linux	CLI · built into Linux	wtmp, btmp, utmp and lastlog
libfsxfslibyal	Library · open source	XFS Forensics
LiME	CLI · open source	Linux Memory Acquisition
localsearchGNOME	CLI · open source	Tracker / LocalSearch DB
logrotate	CLI · built into Linux	logrotate State and Log Gaps
lsof	CLI · built into Linux	/proc Live Artifacts
modinfokmod	CLI · built into Linux	Linux Kernel Modules
mysqlbinlogOracle MySQL	CLI · open source	MySQL, MariaDB and PostgreSQL Logs
Neovim	CLI · open source	viminfo, ShaDa and lesshst
nftnftables	CLI · built into Linux	Linux Firewall Logs
nmcliNetworkManager	CLI · built into Linux	NetworkManager Profiles and State
pgBadger	CLI · open source	MySQL, MariaDB and PostgreSQL Logs
php-malware-finder	CLI · open source	Web Shells in the Web Root
psprocps	CLI · built into Linux	/proc Live Artifacts
pwck / grpckshadow-utils	CLI · built into Linux	/etc/passwd, shadow and group
Python ElementTreePython standard library	Library · open source	recently-used.xbel
python-msgpack	Library · open source	viminfo, ShaDa and lesshst
readelfGNU binutils	CLI · built into Linux	eBPF Programs and Pinned Maps
resolvectlsystemd	CLI · built into Linux	/etc/hosts, nsswitch.conf and resolv.conf on Linux
sealertsetroubleshoot	CLI · built into Linux	AppArmor and SELinux Denials
semoduleSELinux policycoreutils	CLI · built into Linux	AppArmor and SELinux Denials
sestatusSELinux policycoreutils	CLI · built into Linux	AppArmor and SELinux Denials
snapCanonical snapd	CLI · built into Linux	Snap and Flatpak Artifacts
ssh-keygenOpenSSH	CLI · built into Linux	SSH Artifacts
stringsGNU binutils	CLI · built into Linux	PAM Configuration and Modules
sudoreplaysudo	CLI · built into Linux	sudo Logs
sysctlprocps	CLI · built into Linux	sysctl, Boot Parameters and binfmt_misc on Linux
tinysparqlGNOME	CLI · open source	Tracker / LocalSearch DB
trash-cli	CLI · open source	Linux Trash
udevadmsystemd	CLI · built into Linux	udev and USB Device History on Linux
utmpdumputil-linux	CLI · built into Linux	wtmp, btmp, utmp and lastlog
wtmpdb	CLI · open source	wtmp, btmp, utmp and lastlog
xfs_dbxfsprogs	CLI · built into Linux	XFS Forensics
xmllintlibxml2	CLI · open source	recently-used.xbel
YARAVirusTotal	CLI · open source	Web Shells in the Web Root
Zircolite	CLI · open source	auditd audit.log