- Home
- Digital Forensics Software
- Tsurugi Linux
Tsurugi Linux
What it is
Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT. Its 64-bit LAB edition uses Ubuntu 24.04.3 LTS as a base and a custom kernel based on version 6.19.10. Kernel-level write blocking helps prevent changes to examined devices. The distribution includes Computer Vision analysis and an OSINT profile switcher, and supports evidence work involving disks, volatile memory, mobile devices, file systems, operating-system artifacts, and cloud sources. LAB can run live, although the project’s main aim is an installed forensics lab. Tsurugi Acquire is a separate lightweight 32-bit live edition for booting a PC and acquiring storage devices. Bento, a related portable toolkit, contains over 300 applications for live forensics and incident response on Windows, Linux, and macOS. Downloads can be checked with hashes and PGP signatures. The projects are free under GPL and supplied without warranty; some included tools are not open source.
For and against
For
- Kernel-level device write blocking
- Supports disk, memory, mobile, and cloud evidence
- Separate 32-bit acquisition edition
- Bento includes over 300 portable applications
- Free GPL distribution
Against
- Provided without warranty
- Some included tools are not open source
- Dist-upgrade can break LAB
- Project support excludes unrelated basic questions
The verdict
Tsurugi Linux provides a specialized free environment for forensic and incident-response work, with live and installed options plus a separate acquisition edition. Users should follow the project’s verification guidance and account for its warranty and update cautions.
Who it suits
It suits forensic practitioners, incident responders, malware analysts, OSINT users, educators, and law-enforcement personnel. Linux users can install LAB or use the live editions for acquisition work.
Plans and prices
Tsurugi Linux [LAB]
64-bit Linux distribution · provided as-is without warranty
Read 3 Oct 2026 · tsurugi-linux.org
On the record
- Acquisition edition
- Tsurugi Acquire is a lightweight 32-bit live Linux edition for booting a PC and acquiring mass storage devices.tsurugi-linux.org · read 3 Oct 2026
- Audience
- The project describes its goal as educational use and helping law enforcement and professionals with daily tasks.tsurugi-linux.org · read 3 Oct 2026
- Base system
- The 64-bit distribution is based on Ubuntu 24.04.3 LTS and has a custom kernel based on version 6.19.10.tsurugi-linux.org · read 3 Oct 2026
- Deployment
- It can run in live mode, though its main goal is to be installed as a default forensics lab.tsurugi-linux.org · read 3 Oct 2026
- Licensing and warranty
- The project says Tsurugi Linux [LAB] and Tsurugi Acquire are free under the GNU General Public License and provided without warranty; some included tools are not open source.tsurugi-linux.org · read 3 Oct 2026
- Organization
- The project says it is independent, has no commercial brand or company behind it, and is developed in the team's free time.tsurugi-linux.org · read 3 Oct 2026
- Other features
- It includes a Computer Vision analysis section and an OSINT profile switcher.tsurugi-linux.org · read 3 Oct 2026
- Purpose
- Tsurugi Linux is a customized distribution for digital forensics, incident response, malware analysis, and OSINT.tsurugi-linux.org · read 3 Oct 2026
- Related toolkit
- Bento is a portable toolkit with over 300 applications for live forensics and incident response on Windows, Linux, and macOS.tsurugi-linux.org · read 3 Oct 2026
- Security verification
- The downloads page recommends checking hashes and downloading the project's PGP public key to verify signatures.tsurugi-linux.org · read 3 Oct 2026
- Support
- The FAQ says project questions are usually answered by email within 24 to 48 hours, while basic questions unrelated to the project are no longer answered.tsurugi-linux.org · read 3 Oct 2026
- Updates
- Tsurugi Linux [LAB] retrieves updates from official Ubuntu repositories; the FAQ warns that dist-upgrade can break the OS.tsurugi-linux.org · read 3 Oct 2026
- Write blocking
- It includes device write blocking at the kernel level.tsurugi-linux.org · read 3 Oct 2026
