Area 01
Every Linux investigation starts with getting the data out safely. This area covers the order of volatility, live versus dead-box acquisition, forensic disk images and hashing, mounting evidence read-only, and fast triage collection with UAC and Velociraptor.
Key artifacts
How to acquire Linux evidence soundly: order of volatility, live vs dead acquisition, dd/dc3dd/ewfacquire imaging, cloud snapshots and read-only mounts.
Run fast, repeatable Linux triage with UAC profiles and Velociraptor Linux artifacts: what each collects, offline collectors, hunts and what to grab first.
Where each artifact lives, what it proves, its timestamps and the tools to parse it.