Skip to content
Linux Log Parser

Posts tagged: #acquisition

← Back to all posts
Collect Linux Logs for Forensics: tar, UAC, Velociraptor
What to collect for a Linux log investigation and how: one tar command on a live host, journalctl export, ausearch, UAC, Velociraptor, or a mounted disk image.
linux-forensicsacquisitionuacvelociraptor