CINXE.COM

<!DOCTYPE html> <html lang="en" dir="ltr" xmlns:og="https://ogp.me/ns#"> <head> <link rel="profile" href="https://www.w3.org/1999/xhtml/vocab" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut icon" href="https://nostarch.com/sites/default/files/favicon.ico" type="image/vnd.microsoft.icon" /> <meta name="description" content="A practitioner’s guide focused on postmortem analysis of modern Linux installations." /> <meta name="generator" content="Drupal 7 (http://drupal.org)" /> <link rel="image_src" href="https://nostarch.com/sites/default/files/PracticalLinuxForensincs_cover.png" /> <link rel="canonical" href="https://nostarch.com/practical-linux-forensics" /> <link rel="shortlink" href="https://nostarch.com/node/629" /> <meta property="og:type" content="article" /> <meta property="og:url" content="https://nostarch.com/practical-linux-forensics" /> <meta property="og:title" content="Practical Linux Forensics" /> <meta property="og:description" content="A practitioner’s guide focused on postmortem analysis of modern Linux installations." /> <meta property="og:updated_time" content="2023-03-02T11:31:04-08:00" /> <meta property="og:image:url" content="https://nostarch.com/sites/default/files/PracticalLinuxForensincs_cover.png" /> <meta property="og:image:secure_url" content="https://nostarch.com/sites/default/files/PracticalLinuxForensincs_cover.png" /> <meta name="twitter:card" content="summary" /> <meta name="twitter:site" content="@nostarch" /> <meta name="twitter:url" content="https://nostarch.com/practical-linux-forensics" /> <meta name="twitter:title" content="Practical Linux Forensics" /> <meta name="twitter:description" content="A practitioner’s guide focused on postmortem analysis of modern Linux installations." /> <meta name="twitter:image" content="https://nostarch.com/sites/default/files/PracticalLinuxForensincs_cover.png" /> <meta property="product:price:amount" content="59.99" /> <meta property="product:price:currency" content="USD" /> <meta property="product:isbn" content="9781718501966" /> <meta property="article:published_time" content="2021-06-09T14:06:10-07:00" /> <meta property="article:modified_time" content="2023-03-02T11:31:04-08:00" /> <meta property="product:retailer_part_no" content="practicallinuxforensics-combo" /> <meta property="product:mfr_part_no" content="practicallinuxforensics-combo" /> <title>Practical Linux Forensics | No Starch Press</title> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_lQaZfjVpwP_oGNqdtWCSpJT1EMqXdMiU84ekLLxQnc4.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_guSWpwqRBCVb2J7ivC8BaNuaPffCXmbkGB5xDBqKKu8.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_Dw0rmhFX_owMmlf1HH5Y-_BnOHcMlkri1yMjYHD4ffs.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_XJm3Wqia1GUjoI4j54duSLNZVR3Kxhbwy0s3UwuhhHg.css" media="all" />   <script src="//ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script>window.jQuery || document.write("<script src='/sites/all/modules/contrib/jquery_update/replace/jquery/2.2/jquery.min.js'>\x3C/script>")</script> <script src="https://nostarch.com/misc/jquery-extend-3.4.0.js?v=2.2.4"></script> <script src="https://nostarch.com/misc/jquery-html-prefilter-3.5.0-backport.js?v=2.2.4"></script> <script src="https://nostarch.com/misc/jquery.once.js?v=1.2"></script> <script src="https://nostarch.com/misc/drupal.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/modules/contrib/jquery_update/js/jquery_browser.js?v=0.0.1"></script> <script src="https://nostarch.com/misc/form-single-submit.js?v=7.103"></script> <script src="https://nostarch.com/sites/all/modules/contrib/ubercart/uc_file/uc_file.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/libraries/colorbox/jquery.colorbox-min.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/styles/plain/colorbox_style.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox_load.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox_inline.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/modules/contrib/ubercart/uc_cart/uc_cart_block.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/modules/contrib/google_analytics/googleanalytics.js?stn5l0"></script> <script src="https://www.googletagmanager.com/gtag/js?id=UA-5027625-1"></script> <script>window.google_analytics_uacct = "UA-5027625-1";window.dataLayer = window.dataLayer || [];function gtag(){dataLayer.push(arguments)};gtag("js", new Date());gtag("set", "developer_id.dMDhkMT", true);gtag("config", "UA-5027625-1", {"groups":"default","anonymize_ip":true});gtag("config", "G-51XGZT9Y4H", {"groups":"default","anonymize_ip":true});</script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/bootstrap.min.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/main.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/front_grid_height.js?stn5l0"></script> <script>jQuery.extend(Drupal.settings, {"basePath":"\/","pathPrefix":"","setHasJsCookie":0,"ajaxPageState":{"theme":"nostarch","theme_token":"a7PegJta1QOB2_kn7dAK3B318sBhjeQZQncbL3GK89I","js":{"sites\/all\/modules\/contrib\/addthis\/addthis.js":1,"sites\/all\/libraries\/shariff\/shariff.min.js":1,"sites\/all\/themes\/contrib\/bootstrap\/js\/bootstrap.js":1,"\/\/ajax.googleapis.com\/ajax\/libs\/jquery\/2.2.4\/jquery.min.js":1,"0":1,"misc\/jquery-extend-3.4.0.js":1,"misc\/jquery-html-prefilter-3.5.0-backport.js":1,"misc\/jquery.once.js":1,"misc\/drupal.js":1,"sites\/all\/modules\/contrib\/jquery_update\/js\/jquery_browser.js":1,"misc\/form-single-submit.js":1,"sites\/all\/modules\/contrib\/ubercart\/uc_file\/uc_file.js":1,"sites\/all\/libraries\/colorbox\/jquery.colorbox-min.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox.js":1,"sites\/all\/modules\/contrib\/colorbox\/styles\/plain\/colorbox_style.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox_load.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox_inline.js":1,"sites\/all\/modules\/contrib\/ubercart\/uc_cart\/uc_cart_block.js":1,"sites\/all\/modules\/contrib\/google_analytics\/googleanalytics.js":1,"https:\/\/www.googletagmanager.com\/gtag\/js?id=UA-5027625-1":1,"1":1,"sites\/all\/themes\/nostarch\/js\/bootstrap.min.js":1,"sites\/all\/themes\/nostarch\/js\/main.js":1,"sites\/all\/themes\/nostarch\/js\/front_grid_height.js":1},"css":{"modules\/system\/system.base.css":1,"modules\/field\/theme\/field.css":1,"sites\/all\/modules\/contrib\/logintoboggan\/logintoboggan.css":1,"modules\/node\/node.css":1,"sites\/all\/modules\/contrib\/uc_fedex\/uc_fedex.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_file\/uc_file.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_order\/uc_order.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_product\/uc_product.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_store\/uc_store.css":1,"sites\/all\/modules\/contrib\/views\/css\/views.css":1,"sites\/all\/modules\/contrib\/ckeditor\/css\/ckeditor.css":1,"sites\/all\/modules\/contrib\/uc_discounts_alt\/uc_discounts\/uc_discounts.css":1,"sites\/all\/modules\/contrib\/colorbox\/styles\/plain\/colorbox_style.css":1,"sites\/all\/modules\/contrib\/ctools\/css\/ctools.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_cart\/uc_cart_block.css":1,"sites\/all\/libraries\/shariff\/shariff.complete.css":1,"sites\/all\/themes\/nostarch\/css\/en_styles.css":1,"sites\/all\/themes\/nostarch\/css\/custom.css":1,"sites\/all\/themes\/nostarch\/css\/bootstrap-3-vert-offset.css":1,"sites\/all\/themes\/nostarch\/css\/bootstrap-3-autoclear.css":1,"sites\/all\/themes\/nostarch\/css\/glyphicons.css":1}},"colorbox":{"opacity":"0.85","current":"{current} of {total}","previous":"\u00ab Prev","next":"Next \u00bb","close":"Close","maxWidth":"98%","maxHeight":"98%","fixed":true,"mobiledetect":true,"mobiledevicewidth":"480px","file_public_path":"\/sites\/default\/files","specificPagesDefaultValue":"admin*\nimagebrowser*\nimg_assist*\nimce*\nnode\/add\/*\nnode\/*\/edit\nprint\/*\nprintpdf\/*\nsystem\/ajax\nsystem\/ajax\/*"},"better_exposed_filters":{"views":{"topics":{"displays":{"block":{"filters":[]}}},"related_products":{"displays":{"block":{"filters":[]}}}}},"googleanalytics":{"account":["UA-5027625-1","G-51XGZT9Y4H"],"trackOutbound":1,"trackMailto":1,"trackDownload":1,"trackDownloadExtensions":"7z|aac|arc|arj|asf|asx|avi|bin|csv|doc(x|m)?|dot(x|m)?|exe|flv|gif|gz|gzip|hqx|jar|jpe?g|js|mp(2|3|4|e?g)|mov(ie)?|msi|msp|pdf|phps|png|ppt(x|m)?|pot(x|m)?|pps(x|m)?|ppam|sld(x|m)?|thmx|qtm?|ra(m|r)?|sea|sit|tar|tgz|torrent|txt|wav|wma|wmv|wpd|xls(x|m|b)?|xlt(x|m)|xlam|xml|z|zip","trackColorbox":1},"urlIsAjaxTrusted":{"\/practical-linux-forensics":true},"bootstrap":{"anchorsFix":"0","anchorsSmoothScrolling":"0","formHasError":1,"popoverEnabled":1,"popoverOptions":{"animation":1,"html":0,"placement":"right","selector":"","trigger":"click","triggerAutoclose":1,"title":"","content":"","delay":0,"container":"body"},"tooltipEnabled":1,"tooltipOptions":{"animation":1,"html":0,"placement":"auto left","selector":"","trigger":"hover focus","delay":0,"container":"body"}}});</script> </head> <body class="html not-front not-logged-in two-sidebars page-node page-node- page-node-629 node-type-product uc-product-node"> <div id="skip-link"> <a href="#main-content" class="element-invisible element-focusable">Skip to main content</a> </div> <header id="" class="header" role="banner" class="navbar navbar-default"> <div class="container"> <div class="row"> <nav role="navigation" class="navbar navbar-default visible-xs"> <div class="navbar-header"> <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <a class="navbar-brand text-uppercase" href="/"><img src="https://nostarch.com/sites/all/themes/nostarch/logo.png" alt="Home" class="img-responsive"/></a> </div> <div id="navbar" class="navbar-collapse collapse text-center"> <ul class="menu nav navbar-nav"><li class="first leaf"><a href="/catalog.htm" title="Explore our catalog">Catalog</a></li> <li class="leaf"><a href="https://nostarch.com/merchandise-0" title="Merchandise">Merchandise</a></li> <li class="leaf"><a href="/blog" title="The No Starch Press blog">Blog</a></li> <li class="leaf"><a href="https://nostarch.com/early-access-program" title="Media contact">Early Access</a></li> <li class="leaf"><a href="/writeforus" title="Submit a book proposal">Write for Us</a></li> <li class="leaf"><a href="/about" title="About No Starch Press">About Us</a></li> <li class="last leaf"><a href="/contactus" title="Contact Us">Contact Us</a></li> </ul> <div class="region region-navigation"> <section id="block-uc-cart-cart" class="block block-uc-cart clearfix"> <h2 class="block-title"><a href="/cart"><span class="cart-block-icon-empty" title="View your shopping cart."></span></a><span class="cart-block-title-bar" title="Show/hide shopping cart contents.">Shopping cart<span class="cart-block-arrow arrow-down"></span></span></h2> <p class="cart-block-items collapsed uc-cart-empty">There are no products in your shopping cart.</p><table class="cart-block-summary"><tbody><tr><td class="cart-block-summary-items"><span class="num-items">0</span> Items</td><td class="cart-block-summary-total"><label>Total:</label> <span class="uc-price">$0.00</span></td></tr></tbody></table> </section> <section id="block-search-api-page-site-search" class="block block-search-api-page clearfix"> <form action="/practical-linux-forensics" method="post" id="search-api-page-search-form-site-search" accept-charset="UTF-8"><div><div class="form-item form-item-keys-2 form-type-textfield form-group"><input placeholder="Search" class="form-control form-text" type="text" id="edit-keys-2" name="keys_2" value="" size="15" maxlength="128" /> <label class="control-label element-invisible" for="edit-keys-2">Enter your keywords</label> </div><input type="hidden" name="id" value="2" /> <button class="icon glyphicon glyphicon-search btn-primary form-control btn form-submit" type="submit" id="edit-submit-2" name="op" value=""></button> <input type="hidden" name="form_build_id" value="form-T3oorSP4WqMNWJ-Aao8wnk3FSJeaqnYJekAsfstxgog" /> <input type="hidden" name="form_id" value="search_api_page_search_form_site_search" /> </div></form> </section> </div> </div> </nav> <div class="navbar-header"> <div class="logo-wrapper col-sm-6 hidden-xs"> <a class="logo navbar-btn pull-left" href="/" title="Home"> <img src="https://nostarch.com/sites/all/themes/nostarch/logo.png" alt="Home" class="img-responsive"/> </a> </div> <div class="logo-wrapper col-sm-6 hidden-xs"> <div class="region region-navigation"> <div class="region region-navigation"> <section id="block-uc-cart-cart" class="block block-uc-cart clearfix"> <h2 class="block-title"><a href="/cart"><span class="cart-block-icon-empty" title="View your shopping cart."></span></a><span class="cart-block-title-bar" title="Show/hide shopping cart contents.">Shopping cart<span class="cart-block-arrow arrow-down"></span></span></h2> <p class="cart-block-items collapsed uc-cart-empty">There are no products in your shopping cart.</p><table class="cart-block-summary"><tbody><tr><td class="cart-block-summary-items"><span class="num-items">0</span> Items</td><td class="cart-block-summary-total"><label>Total:</label> <span class="uc-price">$0.00</span></td></tr></tbody></table> </section> <section id="block-search-api-page-site-search" class="block block-search-api-page clearfix"> <form action="/practical-linux-forensics" method="post" id="search-api-page-search-form-site-search" accept-charset="UTF-8"><div><div class="form-item form-item-keys-2 form-type-textfield form-group"><input placeholder="Search" class="form-control form-text" type="text" id="edit-keys-2" name="keys_2" value="" size="15" maxlength="128" /> <label class="control-label element-invisible" for="edit-keys-2">Enter your keywords</label> </div><input type="hidden" name="id" value="2" /> <button class="icon glyphicon glyphicon-search btn-primary form-control btn form-submit" type="submit" id="edit-submit-2" name="op" value=""></button> <input type="hidden" name="form_build_id" value="form-T3oorSP4WqMNWJ-Aao8wnk3FSJeaqnYJekAsfstxgog" /> <input type="hidden" name="form_id" value="search_api_page_search_form_site_search" /> </div></form> </section> </div> </div> </div> </div> </div> </div> <div class="container"> <div class="row"> <div class="navbar-collapse collapse"> <nav role="navigation"> <ul class="menu nav navbar-nav"><ul class="menu nav navbar-nav"><li class="first leaf"><a href="/catalog.htm" title="Explore our catalog">Catalog</a></li> <li class="leaf"><a href="https://nostarch.com/merchandise-0" title="Merchandise">Merchandise</a></li> <li class="leaf"><a href="/blog" title="The No Starch Press blog">Blog</a></li> <li class="leaf"><a href="https://nostarch.com/early-access-program" title="Media contact">Early Access</a></li> <li class="leaf"><a href="/writeforus" title="Submit a book proposal">Write for Us</a></li> <li class="leaf"><a href="/about" title="About No Starch Press">About Us</a></li> <li class="last leaf"><a href="/contactus" title="Contact Us">Contact Us</a></li> </ul></ul> </nav> </div> </div> </div> </header> <div class="main-container container"> <header role="banner" id="page-header"> </header>  <div class="row"> <aside class="col-sm-3" role="complementary"> <div class="region region-sidebar-first well"> <section id="block-views-topics-block" class="block block-views clearfix"> <button class="btn btn-primary btn-block visible-xs vert-offset-top-2" data-toggle="collapse" data-target="#topics"><span class="glyphicon glyphicon-menu-down pull-left"></span> <span class="btn-text">Topics</span><span class="glyphicon glyphicon-menu-down pull-right"></span></button> <h2 class="block-title hidden-xs">Topics</h2> <div id="topics" class="view-content collapse dont-collapse animateCollapse"> <div class="view view-topics view-id-topics view-display-id-block view-dom-id-b8ddd065e9b80cf9529ad1320c374bae"> <div class="view-content"> <div class="item-list"> <ul> <li class="views-row views-row-1 views-row-odd views-row-first"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/art-photography-design">Art & Design</a></span> </div></li> <li class="views-row views-row-2 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/general-computing">General Computing</a></span> </div></li> <li class="views-row views-row-3 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/security">Hacking & Computer Security</a></span> </div></li> <li class="views-row views-row-4 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/hardware-and-diy">Hardware / DIY</a></span> </div></li> <li class="views-row views-row-5 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/kids">Kids</a></span> </div></li> <li class="views-row views-row-6 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/lego">LEGO®</a></span> </div></li> <li class="views-row views-row-7 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/linux-bsd-unix">Linux & BSD</a></span> </div></li> <li class="views-row views-row-8 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/manga">Manga</a></span> </div></li> <li class="views-row views-row-9 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/programming">Programming</a></span> </div></li> <li class="views-row views-row-10 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/python">Python</a></span> </div></li> <li class="views-row views-row-11 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/rforall">R for All</a></span> </div></li> <li class="views-row views-row-12 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/science-math">Science & Math</a></span> </div></li> <li class="views-row views-row-13 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/scratch">Scratch</a></span> </div></li> <li class="views-row views-row-14 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/system-administration">System Administration</a></span> </div></li> <li class="views-row views-row-15 views-row-odd views-row-last"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/early-access">Early Access</a></span> </div></li> </ul></div> </div> <div class="view-footer"> <style> <![CDATA[/* ><!]]>*/ </style> </div> </div> </div> </section><section id="block-block-12" class="block block-block clearfix"> <div class="rounded_border_block"><span style="font-family:Arial,Helvetica,sans-serif"><strong><span style="font-size:12px"><span style="color:#c0392b"><a href="https://nostarch.com/about_ebooks.htm">FREE ebook edition with every print book purchased from nostarch.com!</a></span></span></strong></span></div> <p class="rtecenter"><span style="font-size:22px">+</span></p> <div class="rounded_border_block"><span style="font-family:Arial,Helvetica,sans-serif"><strong><span style="font-size:12px"><a href="https://nostarch.com/early-access-program"><span style="color:#c0392b">EARLY ACCESS lets you read full chapters months before a title's release date!</span></a></span></strong></span></div> </section> <section id="block-nostarch-custom-login-block" class="block block-nostarch-customclearfix"> <h2 class="block-title">User login</h2> <ul> <li><a href="/user">Log in</a></a></li> <li><a href="/user/register">Create account</a></a></li> </ul> </section> <section id="block-block-78" class="block block-block clearfix"> <script data-account="eeqOpWOUyZ" src="https://cdn.userway.org/widget.js"></script> </section> </div> </aside>  <section class="col-sm-6" style=""> <a id="main-content"></a> <div class="region region-content"> <section id="block-system-main" class="block block-system clearfix"> <div class="ds-1col node node-product view-mode-full clearfix"> <div class=""> <div class="field field-name-field-image-cache field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><div class="product-image"><div class="main-product-image"><a href="https://nostarch.com/sites/default/files/styles/uc_product_full/public/PracticalLinuxForensincs_cover.png?itok=7Vt30V4b" title="Practical Linux Forensics Cover" class="colorbox" rel="uc_image_0"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/uc_product/public/PracticalLinuxForensincs_cover.png?itok=8f63-gWz" alt="Practical Linux Forensics Cover" title="Practical Linux Forensics Cover" /></a></div></div></div></div></div><div class="field field-name-entity-title field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even"><h1 class="page-header">Practical Linux Forensics</h1></div></div></div><div class="field field-name-field-subtitle field-type-text field-label-hidden"><div class="field-items"><div class="field-item even">A Guide for Digital Investigators</div></div></div><div class="field field-name-field-author field-type-text field-label-hidden"><div class="field-items"><div class="field-item even">by Bruce Nikkel</div></div></div><div class="field field-name-released-date field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even">November 2021, 400 pp.</div></div></div><div class="field field-name-field-isbn13 field-type-text field-label-inline clearfix clearfix"><div class="field-label">ISBN-13: </div><div class="field-items"><div class="field-item even">9781718501966</div></div></div><div class="add-to-cart"><form action="/practical-linux-forensics" method="post" id="uc-product-add-to-cart-form-629" accept-charset="UTF-8"><div><div id="uc_product_add_to_cart_form-629-attributes" class="attributes"><div class="attribute attribute-1 odd"><div class="form-item form-item-attributes-1 form-type-radios form-group"><div id="edit-attributes-1" class="form-radios"><div class="form-item form-item-attributes-1 form-type-radio radio"> <label class="control-label" for="edit-attributes-1-3"><input type="radio" id="edit-attributes-1-3" name="attributes[1]" value="3" checked="checked" class="form-radio" />Print Book and FREE Ebook, $59.99</label> </div><div class="form-item form-item-attributes-1 form-type-radio radio"> <label class="control-label" for="edit-attributes-1-2"><input type="radio" id="edit-attributes-1-2" name="attributes[1]" value="2" class="form-radio" />Ebook (PDF, Mobi, and ePub), $47.99</label> </div></div></div></div></div><input type="hidden" name="qty" value="1" /> <input type="hidden" name="form_build_id" value="form-irTaYCkhrbiJICwJ1z9wkkeysqZ6PWmoH-zFrpGwlTo" /> <input type="hidden" name="form_id" value="uc_product_add_to_cart_form_629" /> <div class="form-actions form-wrapper form-group" id="edit-actions"><button class="node-add-to-cart btn btn-success form-submit icon-before" type="submit" id="edit-submit-629" name="op" value="Add to cart"><span class="icon glyphicon glyphicon-plus" aria-hidden="true"></span> Add to cart</button> </div></div></form></div><div class="field field-name-product-menu field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even"><div class="menu-wrapper"><ul class="menu nav"><li><a href="#content">Contents</a></li><li><a href="#reviews">Reviews</a></li><li><a href="#updates">Updates</a></li></ul></div></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p><a href="/download/samples/PracticalLinuxForensics_Ch5_090121.pdf" target="_blank" class="btn btn-success downloadbutton" style="font-weight: 400;">Download Chapter 5: INVESTIGATING EVIDENCE FROM LINUX LOGS</a></p> <p><b>Look Inside!</b></p> <div class="lookinside" style:=""> <p><a href="/images/PracticalLinuxForensincs_back.png" class="colorbox"><img src="/images/PracticalLinuxForensincs_back.png" title="Practical Linux Forensics back cover" alt="Practical Linux Forensics back cover" style="border:1px solid; margin:5px; height:102px;" /></a><a href="/images/PracticalLinuxForensics_spreads.png" class="colorbox"><img src="/images/PracticalLinuxForensics_spreads.png" title="Practical Linux Forensics interior spread" alt="Practical Linux Forensics interior spread" style="border:1px solid; margin:5px; height:102px;" /></a><a href="/images/PracticalLinuxForensics_spreads2.png" class="colorbox"><img src="/images/PracticalLinuxForensics_spreads2.png" title="Practical Linux Forensics interior spread" alt="Practical Linux Forensics interior spread" style="border:1px solid; margin:5px; height:102px;" /></a><a href="/images/PracticalLinuxForensics_spreads3.png" class="colorbox"><img src="/images/PracticalLinuxForensics_spreads3.png" title="Practical Linux Forensics interior spread" alt="Practical Linux Forensics interior spread" style="border:1px solid; margin:5px; height:102px;" /></a><a href="/images/PracticalLinuxForensics_spreads4.png" class="colorbox"><img src="/images/PracticalLinuxForensics_spreads4.png" title="Practical Linux Forensics interior spread" alt="Practical Linux Forensics interior spread" style="border:1px solid; margin:5px; height:102px;" /></a><a href="/images/PracticalLinuxForensics_spreads5.png" class="colorbox"><img src="/images/PracticalLinuxForensics_spreads5.png" title="Practical Linux Forensics interior spread" alt="Practical Linux Forensics interior spread" style="border:1px solid; margin:5px; height:102px;" /></a></p></div> <p><i>Practical Linux Forensics</i> dives into the technical details of analyzing postmortem forensic images of Linux systems that have been misused, abused, or the target of malicious attacks. This essential practitioner’s guide will show you how to locate and interpret digital evidence found on Linux desktops, servers, and IoT devices, draw logical conclusions, and reconstruct timelines of past activity after a crime or security incident. It's a book written for investigators with varying levels of Linux experience, and the techniques shown are independent of the forensic analysis platform and tools used.</p> <p>Early chapters provide an overview of digital forensics as well as an introduction to the Linux operating system and popular distributions. From there, the book describes the analysis of storage, filesystems, files and directories, installed software packages, and logs. Special focus is given to examining human user activity such as logins, desktop environments and artifacts, home directories, regional settings, and peripheral devices used.</p> <p>You’ll learn how to:</p> <ul> <li>Analyze partition tables, volume management, Linux filesystems, and directory layout </li><li>Reconstruct the Linux startup process, from system boot and kernel initialization, to systemd unit files leading up to a graphical login </li><li>Perform historical analysis of power, temperature, and physical environment, and find evidence of sleep, hibernation, shutdowns, reboots, and crashes </li><li>Analyze network configuration, including interfaces, addresses, network managers, DNS, wireless artifacts, VPNs, firewalls, and proxy settings </li><li>Perform analysis of time and locale settings, internationalization (language and keyboard settings), and Linux geolocation services </li><li>Reconstruct user login sessions, analyze desktop artifacts, and identify traces of attached peripheral devices, including disks, printers, and mobile devices </li></ul> </div></div></div><div class="field field-name-field-author-bio field-type-text-long field-label-abovec"><div class="field-label">Author Bio </div><div class="field-items"><div class="field-item even"><p><b>Bruce Nikkel</b> is a professor at the Bern University of Applied Sciences in Switzerland, specializing in digital forensics and cybercrime. He is co-head of the university’s research institute for cybersecurity and engineering, and director of the Masters program in Digital Forensics and Cyber Investigation.In addition to his academic work, he has worked in risk and security departments at a global financial institution since 1997. He headed the bank's Cybercrime Intelligence & Forensic Investigation team for more than 15 years and currently works as an advisor. Bruce holds a PhD in network forensics, is the author of <i>Practical Forensic Imaging</i> (No Starch Press, 2016), and is an editor with Forensic Science International’s <i>Digital Investigation</i> journal. He has been a Unix and Linux enthusiast since the 1990s.</p> </div></div></div><div class="field field-name-field-toc field-type-text-long field-label-abovec" id="content"><div class="field-label">Table of contents </div><div class="field-items"><div class="field-item even"><p><b>Introduction</b><br /> <b>Chapter 1:</b> Digital Forensics Overview<br /> <b>Chapter 2:</b> Linux Overview<br /> <b>Chapter 3:</b> Evidence from Storage Devices and Filesystems<br /> <b>Chapter 4:</b> Directory Layout and Forensic Analysis of Linux Files<br /> <b>Chapter 5:</b> Investigating Evidence from Linux Logs<br /> <b>Chapter 6:</b> Reconstructing System Boot and Initialization<br /> <b>Chapter 7:</b> Examination of Installed Software Packages<br /> <b>Chapter 8:</b> Identifying Network Configuration Artifacts<br /> <b>Chapter 9:</b> Forensic Analysis of Time and Location<br /> <b>Chapter 10:</b> Reconstructing User Desktops and Login Activity<br /> <b>Chapter 11:</b> Forensic Traces of Attached Peripheral Devices<br /> <b>Afterword</b><br /> <b>Appendix A:</b> File and Directory List for Digital Investigators</p> <p><a href="download/samples/PLF_copyright.pdf" target="_blank" style="text-decoration:underline;"><b>View the Copyright page</b></a><br /> <a href="/download/samples/PLF_detailed_TOC.pdf" target="_blank" style="text-decoration:underline;"><b>View the detailed Table of Contents</b></a><br /> <a href="/download/samples/PLF_index.pdf" target="_blank" style="text-decoration:underline;"><b>View the Index</b></a> </p> </div></div></div><div class="field field-name-field-reviews field-type-text-long field-label-abovec" id="reviews"><div class="field-label">Reviews </div><div class="field-items"><div class="field-item even"><p>“<i>Practical Linux Forensics</i> is an excellent resource suitable for those new to Linux, as well as for experienced users. Whether you are an investigator, administrator, developer, or curious student, you will gain imperative knowledge that can easily be applied to your own field and endeavors.”<br /> <b>—Techtyte, Cybersecurity Researcher and Advanced Reviewer</b></p> <p>"Thorough . . . Even if this is your first foray into computer forensics, there is a lot to be gained from Nikkel’s book."<br /> <b>—Lee Teschler, Microcontroller Tips</b></p> <p>"A comprehensive and informative guide . . . The author provides a wealth of information and practical tips that can be used in real-world scenarios, making it a valuable resource for both professionals and students. It is a must-read for anyone looking to gain a deeper understanding of forensic analysis on Linux systems."<br /> <b>—The Security Noob</b></p> <p>"After <i>Practical Forensic Imaging</i>, Bruce Nikkel has produced another fantastic learning resource and reference in <i>Practical Linux Forensics</i>. Made both for professionals more familiar with Windows or macOS forensics as well as adept Linux users looking to learn forensics, it does not need to be read linearly. Each chapter provides focused knowledge on different aspects of Linux systems in a distribution-agnostic manner. Definitely grab a copy to demystify this area of computer forensics."<br /> <b>—Daniyal S., Advanced Reviewer</b></p> <p>"Bruce Nikkel shares some [insight on] really uncommon and least understood areas of the Linux network stack, which will be very valuable for practitioners . . . [<i>Practical Linux Forensics</i>] touches on areas ignored by other resources on the subject."<br /> <b>—Arvind, Advanced Reviewer</b></p> </div></div></div><div class="field field-name-field-updates field-type-text-long field-label-abovec" id="updates"><div class="field-label">Updates </div><div class="field-items"><div class="field-item even"><p>View the <a href="/download/PracticalLinuxForensics_errata_p2.pdf" target="_blank" style="text-decoration:underline;"><u><b>latest errata</b></u></a>.</p> </div></div></div> </div> </div> </section> <section id="block-shariff-shariff-block" class="block block-shariff clearfix"> <div class="shariff" data-services="["facebook","print","twitter"]" data-theme="colored" data-orientation="horizontal" data-twitter-via="nostarch" data-lang="en"></div> </section> </div> </section> <aside class="col-sm-3" role="complementary"> <div class="region region-sidebar-second"> <section id="block-system-navigation" class="block block-system block-menu clearfix"> <h2 class="block-title">Navigation</h2> <ul class="menu nav"><li class="first last leaf"><a href="/user" title="">My account</a></li> </ul> </section> <section id="block-block-52" class="block block-block clearfix"> <p><a href="/mailchimp/subscribe">Want sweet deals? <br />Sign up for our newsletter.</a></p> </section> <section id="block-views-related-products-block" class="block block-views clearfix"> <h2 class="block-title">You might also like...</h2> <div class="view view-related-products view-id-related_products view-display-id-block auto-clear view-dom-id-ebf6c61c8751644edbb084e7b607634e"> <div class="view-content"> <div class="views-row views-row-1 views-row-odd views-row-first col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/practical-iot-hacking"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/9781718500907.png?itok=E6ueps7a" width="90" height="118" alt="Practical IoT Hacking cover" title="Practical IoT Hacking cover" /></a></div> </div> </div> <div class="views-row views-row-2 views-row-even col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/art-mac-malware-v2"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/ArtMacMalwarev2_frontcover.png?itok=lu7lBKkY" width="90" height="119" alt="The Art of Mac Malware, Volume 2 cover" title="The Art of Mac Malware, Volume 2 cover" /></a></div> </div> </div> <div class="views-row views-row-3 views-row-odd col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/smartgirlsguide"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/sggp_frontcvr_final.png?itok=8Vjrunvd" width="90" height="136" alt="The Smart Girl's Guide to Privacy" title="The Smart Girl's Guide to Privacy" /></a></div> </div> </div> <div class="views-row views-row-4 views-row-even col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/ethical-hacking"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/9781718501874.png?itok=e3h8Cbjy" width="90" height="120" alt="Ethical Hacking Cover" title="Ethical Hacking Cover" /></a></div> </div> </div> <div class="views-row views-row-5 views-row-odd col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/firewalls.htm"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/firewalls_big.jpg?itok=lNCTURkk" width="90" height="119" alt="Linux Firewalls" title="Linux Firewalls" /></a></div> </div> </div> <div class="views-row views-row-6 views-row-even views-row-last col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/black-hat-graphql"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/BlackHatGraphQL_CV_F.png?itok=cKHzhYck" width="90" height="119" alt="Black Hat GraphQL Cover" title="Black Hat GraphQL Cover" /></a></div> </div> </div> </div> </div> </section> </div> </aside>  </div> </div> <footer class="footer container"> <div class="region region-footer"> <section id="block-block-16" class="block block-block clearfix"> <div id="footer-links"> <br> <a class="footer-links" href="/about.htm">About Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/Jobs.htm">Jobs!</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/distribution.htm">Sales and Distribution</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/rights">Rights</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/media.htm">Media</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/academic.htm">Academic Requests</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/conferences.htm">Conferences</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/orderfaq.htm">FAQ</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/contactus">Contact Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/writeforus">Write for Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/privacypolicy.htm">Privacy</a> </div> </section> <section id="block-nostarch-custom-custom-footer-copyright" class="block block-nostarch-custom clearfix"> <div class="block-block"> <p>Copyright 2025. No Starch Press, Inc</p> </div> </section> </div> </footer> <script src="https://nostarch.com/sites/all/modules/contrib/addthis/addthis.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/libraries/shariff/shariff.min.js?stn5l0"></script> <script src="https://nostarch.com/sites/all/themes/contrib/bootstrap/js/bootstrap.js?stn5l0"></script>  <script> !function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement("script");t.src="https://www.redditstatic.com/ads/pixel.js",t.async=!0;var s=d.getElementsByTagName("script")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','t2_6acpsf9y');rdt('track', 'PageVisit'); </script>   <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'929e2f665e47fdcc',t:'MTc0MzU3NDQ1Ny4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body> </html>