Skip to content
SPECIFICTION
Get listed

Tsurugi Linux

tsurugi-linux.org

Free plan Linux
Visit tsurugi-linux.org
Spec score 7.1 #26 of 30 in Digital Forensics Software

What it is

Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT. Its 64-bit [LAB] edition is based on Ubuntu 24.04.3 LTS with a custom kernel based on version 6.19.10, including kernel-level device write blocking. It also provides a Computer Vision analysis section and an OSINT profile switcher. The system can run live, although the project’s primary aim is an installed forensics lab. Tsurugi Acquire is a separate lightweight 32-bit live edition for booting a computer and acquiring mass-storage devices. The related Bento toolkit contains over 300 applications for live forensics and incident response on Windows, Linux, and macOS. The project recommends checking image hashes and verifying signatures with its PGP public key. [LAB] updates come from official Ubuntu repositories, but the FAQ warns that dist-upgrade can break the operating system. Tsurugi Linux [LAB] and Tsurugi Acquire are free under the GNU General Public License and supplied without warranty; some included tools are not open source. Evidence work can cover disks, volatile memory, mobile devices, file systems, OS artifacts, and cloud sources.

Spec sheet

Purpose
Tsurugi Linux is a customized distribution for digital forensics, incident response, malware analysis, and OSINT.Read 3 Oct 2026 · tsurugi-linux.org
Audience
The project describes its goal as educational use and helping law enforcement and professionals with daily tasks.Read 3 Oct 2026 · tsurugi-linux.org
Deployment
It can run in live mode, though its main goal is to be installed as a default forensics lab.Read 3 Oct 2026 · tsurugi-linux.org
Support
The FAQ says project questions are usually answered by email within 24 to 48 hours, while basic questions unrelated to the project are no longer answered.Read 3 Oct 2026 · tsurugi-linux.org
Founded
2018Read 28 Sep 2026 · tsurugi-linux.org
Acquisition edition
Tsurugi Acquire is a lightweight 32-bit live Linux edition for booting a PC and acquiring mass storage devices.Read 3 Oct 2026 · tsurugi-linux.org
Base system
The 64-bit distribution is based on Ubuntu 24.04.3 LTS and has a custom kernel based on version 6.19.10.Read 3 Oct 2026 · tsurugi-linux.org
Licensing and warranty
The project says Tsurugi Linux [LAB] and Tsurugi Acquire are free under the GNU General Public License and provided without warranty; some included tools are not open source.Read 3 Oct 2026 · tsurugi-linux.org
Organization
The project says it is independent, has no commercial brand or company behind it, and is developed in the team's free time.Read 3 Oct 2026 · tsurugi-linux.org
Other features
It includes a Computer Vision analysis section and an OSINT profile switcher.Read 3 Oct 2026 · tsurugi-linux.org
Related toolkit
Bento is a portable toolkit with over 300 applications for live forensics and incident response on Windows, Linux, and macOS.Read 3 Oct 2026 · tsurugi-linux.org
Security verification
The downloads page recommends checking hashes and downloading the project's PGP public key to verify signatures.Read 3 Oct 2026 · tsurugi-linux.org
Updates
Tsurugi Linux [LAB] retrieves updates from official Ubuntu repositories; the FAQ warns that dist-upgrade can break the OS.Read 3 Oct 2026 · tsurugi-linux.org
Write blocking
It includes device write blocking at the kernel level.Read 3 Oct 2026 · tsurugi-linux.org

Plans and prices

Tsurugi Linux [LAB] Free 64-bit Linux distribution · provided as-is without warranty Read 3 Oct 2026 · tsurugi-linux.org

Every Tsurugi Linux plan and price →

Strong points and limits

Strong points

  • Kernel-level write blocking
  • Dedicated forensic and OSINT focus
  • Live and installed-lab deployment options
  • Acquire edition targets storage acquisition
  • Bento includes over 300 portable tools

Limits

  • Provided without warranty
  • Some included tools are not open source
  • Dist-upgrade can break the operating system
  • Project support excludes unrelated basic questions

Who it suits

It suits forensic practitioners, incident responders, malware analysts, OSINT users, educators, law-enforcement personnel, and professionals needing a Linux investigation environment. Its live editions also support acquisition and portable response work.

Verdict

Tsurugi Linux offers a purpose-built forensic environment with write protection, acquisition tooling, and portable companions. Treat it as an as-is system, verify downloads, and follow the update cautions before operational use.

Where Specifiction places it

Alternatives to Tsurugi LinuxAll alternatives →