Tsurugi Linux review
A broad, free DFIR toolkit for investigators who work in Linux environments.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Tsurugi Linux is a free, open-source Linux distribution for digital forensics, incident response and OSINT. Tsurugi Linux LAB provides a 64-bit Ubuntu-based forensic workstation for law-enforcement professionals, investigators, security practitioners and people learning DFIR workflows. It supports evidence from disk images, volatile memory, mobile devices, file systems, OS artifacts, cloud environments, virtual machines and network data. The project can run in live mode, be installed as a forensic workstation or used as an official OVA virtual machine.
Its main strength is breadth within a Linux-based forensic environment. The toolkit includes kernel-level device write blocking, disk imaging, mounting and forensic image processing, memory acquisition and analysis, timeline and artifact analysis, malware analysis, cloud analysis, OSINT with profile switching, and reporting utilities. Mobile coverage includes Android, iOS, BlackBerry and mobile-application forensics. Disk-image export formats include AFF, EWF and RAW, while supported environments include Linux 64-bit, Ubuntu 24.04.3 LTS, VirtualBox and VMware.
Tsurugi Linux is a strong choice for teams and learners seeking a free workstation that brings multiple DFIR disciplines into one Linux distribution. Its live, installed and virtual-machine options support different operating preferences, but the platform focus makes it less suitable for organizations seeking a native Windows or macOS forensic workstation. The project is described as open source, although included tools may have different licenses and some are not open source. Choose Tsurugi Linux when free Linux tooling and broad forensic coverage are priorities; consider an alternative when a commercial support model, uniform licensing or another desktop platform is required.
Tsurugi Linux pros and cons
- Where it wins
- Free, open-source distribution covering broad DFIR workflows
- Kernel-level write blocking and disk imaging support
- Includes memory, mobile, cloud, malware and OSINT tools
- Where it doesn't
- Linux-only platform focus limits cross-platform workstation use
- Included tools may have different licenses
- Broad tool coverage may require DFIR workflow familiarity
Tsurugi Linux fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update