Using Linux as a Wo...
 
Notifications
Clear all

Using Linux as a Workstation

Jchuntley
(@jchuntley)
New Member

Hello,

I'm currently enrolled in a bachelors degree for DF and I'm wanting to get a bit of practice in outside of my classes, I generally prefer Linux to Windows for a number of reasons, and I know that I'll eventually need to transition to Windows because Linux doesn't support some of the bigger names like EnCase. My question is, can I use Linux for the time being and still get quality practice? If so is their any recommended distros, or will just about any work? and lastly, I started reading LinuxLeo a book on digital forensics for law enforcement and they recommended Slackware, has anyone here used it, and if so how did go?

 

Thanks in advance

Quote
Topic starter Posted : 17/02/2021 3:37 am
Topic Tags
Bunnysniper
(@bunnysniper)
Active Member
Posted by: @jchuntley

My question is, can I use Linux for the time being and still get quality practice? If so is their any recommended distros, or will just about any work?

My recommendation after >20 years of experience: a Windows 10 machine and Ubuntu as distro for the Linux on Windows subsystem. This Linux subsystem is doing everything you can expect from a CLI Linux OS. Once Ubuntu is running, you can use the SANS bootstrap installer for SIFT.
https://github.com/teamdfir/sift-saltstack

Then you have fully optimised Linux environment in case you need it. 
And Windows will then serve X-Ways Forensics, FTK Imager and other well known and important forensic tools.

 

regards, Robin

 

ReplyQuote
Posted : 17/02/2021 2:48 pm
minime2k9
(@minime2k9)
Active Member

The above seems good, use Windows and VM's.

I think X-Ways will work with WINE or similar though, maybe WinHex can be used while you are a student.

ReplyQuote
Posted : 17/02/2021 3:00 pm
Bunnysniper
(@bunnysniper)
Active Member

Sorry, but there are clear differences between a VM and the WSL Subsystem. "Linux on Windows" is implemented as an additional layer that can execute ELF binaries. It is not a virtual machine with a separate hypervisor. 

https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux

And yes, there are ways to run X-Ways in Linux, but do not expect the same performance as if you would run it native on Windows.

 

regards, Robin

ReplyQuote
Posted : 17/02/2021 10:57 pm
Passmark
(@passmark)
Active Member

It is not a virtual machine

Except that the article you linked to says it is in fact a virtual machine.

"The architecture was redesigned in WSL2 [in 2019], with a Linux kernel running in a lightweight virtual machine environment .......  based on a subset of Hyper-V features".

We did some performance benchmarking in WSL, it was only 8% slower than the host Windows system. So not too bad.

ReplyQuote
Posted : 22/02/2021 5:58 am
Bunnysniper
(@bunnysniper)
Active Member

@passmark

It is then really "lightweight" (ever heard the term before?) and not visible in the Hyper-V manager or additional processes. Checked it myself and it is not handled in the way a VM is normally managed by this hypervisor.

I guess simply some additional DLL are used for abstraction.

regards, Robin

ReplyQuote
Posted : 24/02/2021 9:40 am
Share: