Using Linux as a Wo...
Clear all

Using Linux as a Workstation

7 Posts
5 Users
0 Reactions
Posts: 1
New Member
Topic starter


I'm currently enrolled in a bachelors degree for DF and I'm wanting to get a bit of practice in outside of my classes, I generally prefer Linux to Windows for a number of reasons, and I know that I'll eventually need to transition to Windows because Linux doesn't support some of the bigger names like EnCase. My question is, can I use Linux for the time being and still get quality practice? If so is their any recommended distros, or will just about any work? and lastly, I started reading LinuxLeo a book on digital forensics for law enforcement and they recommended Slackware, has anyone here used it, and if so how did go?


Thanks in advance

Posted : 17/02/2021 4:37 am
Posts: 259
Reputable Member
Posted by: @jchuntley

My question is, can I use Linux for the time being and still get quality practice? If so is their any recommended distros, or will just about any work?

My recommendation after >20 years of experience: a Windows 10 machine and Ubuntu as distro for the Linux on Windows subsystem. This Linux subsystem is doing everything you can expect from a CLI Linux OS. Once Ubuntu is running, you can use the SANS bootstrap installer for SIFT.

Then you have fully optimised Linux environment in case you need it. 
And Windows will then serve X-Ways Forensics, FTK Imager and other well known and important forensic tools.


regards, Robin


Posted : 17/02/2021 3:48 pm
Posts: 481
Honorable Member

The above seems good, use Windows and VM's.

I think X-Ways will work with WINE or similar though, maybe WinHex can be used while you are a student.

Posted : 17/02/2021 4:00 pm
Posts: 259
Reputable Member

Sorry, but there are clear differences between a VM and the WSL Subsystem. "Linux on Windows" is implemented as an additional layer that can execute ELF binaries. It is not a virtual machine with a separate hypervisor.

And yes, there are ways to run X-Ways in Linux, but do not expect the same performance as if you would run it native on Windows.


regards, Robin

Posted : 17/02/2021 11:57 pm
Posts: 376
Reputable Member

It is not a virtual machine

Except that the article you linked to says it is in fact a virtual machine.

"The architecture was redesigned in WSL2 [in 2019], with a Linux kernel running in a lightweight virtual machine environment .......  based on a subset of Hyper-V features".

We did some performance benchmarking in WSL, it was only 8% slower than the host Windows system. So not too bad.

Posted : 22/02/2021 6:58 am
Posts: 259
Reputable Member


It is then really "lightweight" (ever heard the term before?) and not visible in the Hyper-V manager or additional processes. Checked it myself and it is not handled in the way a VM is normally managed by this hypervisor.

I guess simply some additional DLL are used for abstraction.

regards, Robin

Posted : 24/02/2021 10:40 am
Posts: 26
Eminent Member

Windows is a great tool, no doubt about it. Linux, however, is a weapon. Nowadays assembling and operating weapons is easier than ever, all the elements are out there, it is just a matter of piecing them together. Tools will do for most jobs, but sometimes you do need a weapon. Below you can see a little video I made for entertainment purposes showcasing how Debian GNU/Linux can be applied for digital forensics work. Hope it will inspire someone to go and tinker with Linux 🙂

Posted : 01/05/2022 6:53 am