Tsurugi Linux
Tsurugi Linux: A broad, free DFIR toolkit for investigators who work in Linux environments. Ranked #18 of 30 in Digital Forensics Software by our editors (7.5/10); pricing: Free plan; best for free Linux forensic and response toolkit.
At a glance
- Editor score7.5 / 10
- PricingFree plan
- Best forFree Linux forensic and response toolkit
- Free planYes
- Paid fromFree
- Mobile forensicsYes
- Founded2018
- Facts checked20 Sep 2026
Where it wins
- Free, open-source distribution covering broad DFIR workflows
- Kernel-level write blocking and disk imaging support
- Includes memory, mobile, cloud, malware and OSINT tools
Where it doesn't
- Linux-only platform focus limits cross-platform workstation use
- Included tools may have different licenses
- Broad tool coverage may require DFIR workflow familiarity
Our verdict on Tsurugi Linux
Tsurugi Linux is a free, open-source Linux distribution for digital forensics, incident response and OSINT. Tsurugi Linux LAB provides a 64-bit Ubuntu-based forensic workstation for law-enforcement professionals, investigators, security practitioners and people learning DFIR workflows. It supports evidence from disk images, volatile memory, mobile devices, file systems, OS artifacts, cloud environments, virtual machines and network data. The project can run in live mode, be installed as a forensic workstation or used as an official OVA virtual machine.
Its main strength is breadth within a Linux-based forensic environment. The toolkit includes kernel-level device write blocking, disk imaging, mounting and forensic image processing, memory acquisition and analysis, timeline and artifact analysis, malware analysis, cloud analysis, OSINT with profile switching, and reporting utilities. Mobile coverage includes Android, iOS, BlackBerry and mobile-application forensics. Disk-image export formats include AFF, EWF and RAW, while supported environments include Linux 64-bit, Ubuntu 24.04.3 LTS, VirtualBox and VMware.
Tsurugi Linux is a strong choice for teams and learners seeking a free workstation that brings multiple DFIR disciplines into one Linux distribution. Its live, installed and virtual-machine options support different operating preferences, but the platform focus makes it less suitable for organizations seeking a native Windows or macOS forensic workstation. The project is described as open source, although included tools may have different licenses and some are not open source. Choose Tsurugi Linux when free Linux tooling and broad forensic coverage are priorities; consider an alternative when a commercial support model, uniform licensing or another desktop platform is required.
Your product? Our editors can test Tsurugi Linux in depth and publish a review, labelled as paid · from $149/mo →
Tsurugi Linux pricing
Tsurugi Linux fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Evidence sources | disk images; volatile memory; mobile devices; file systems; OS artifacts; cloud environments; virtual machines; network data |
| Mobile forensics | Yes |
| Disk imaging | Yes |
| Memory forensics | Yes |
| Case collaboration | Not verified |
| Supported platforms | Linux 64-bit; Ubuntu 24.04.3 LTS; VirtualBox; VMware |
| Export formats | AFF; EWF; RAW |
| Deployment | Self-hosted |
| Platforms | Linux |
| Support | Email, Docs, Community |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan |
| Website | tsurugi-linux.org |
| Facts checked | 20 Sep 2026 |
Alternatives to Tsurugi Linux
- AutopsyA free, cross-platform platform for broad, case-based digital investigations.9.4
- Paraben E3 Forensic PlatformA broad evidence-processing platform for teams handling varied digital investigations.9.3
- Magnet AXIOM CyberA broad investigation platform for collecting and analyzing endpoint, mobile, cloud, and memory evidence.9.2
See all Tsurugi Linux alternatives →
Used Tsurugi Linux? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Tsurugi Linux for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Tsurugi Linux is listed in our Digital Forensics Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/tsurugi-linux/"><img src="https://www.itechguides.com/best/badge/tsurugi-linux.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update