Tsurugi Linux
Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT.
What Tsurugi Linux is
Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT. Its 64-bit [LAB] edition is based on Ubuntu 24.04.3 LTS and uses a custom kernel based on version 6.19.10. Kernel-level device write blocking is included, alongside a Computer Vision analysis section and an OSINT profile switcher. The distribution can run live, though its main goal is use as an installed forensics lab. Tsurugi Acquire is a separate lightweight 32-bit live edition for booting a PC and acquiring mass storage devices. The related Bento portable toolkit contains over 300 applications for live forensics and incident response on Windows, Linux, and macOS. [LAB] updates come from official Ubuntu repositories, and the FAQ cautions that a dist-upgrade can break the OS. The project recommends checking download hashes and using its PGP public key to verify signatures. The distributions are provided without warranty, and some included tools are not open source.
Good
- Includes kernel-level device write blocking
- Offers a separate live acquisition edition
- Bento includes over 300 applications
- Free under the GNU General Public License
Watch out
- Provided without warranty
- Some included tools are not open source
- A dist-upgrade can break the OS
Who it suits
Tsurugi Linux is intended for educational use and for law enforcement and professionals working in forensics, incident response, malware analysis, or OSINT.
Verdict
Tsurugi Linux offers a specialized toolkit for forensic and incident-response work, including a separate acquisition edition and the Bento toolkit. Users should note its no-warranty terms and the warning about dist-upgrade.
Plans and prices
From Tsurugi Linux's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Tsurugi Linux [LAB] | Free | 64-bit Linux distribution · provided as-is without warranty |
The facts
Each one read from Tsurugi Linux's own pages, with the date it was checked.
What it does
- Acquisition edition
- Tsurugi Acquire is a lightweight 32-bit live Linux edition for booting a PC and acquiring mass storage devices.checked 3 Oct 2026
- Audience
- The project describes its goal as educational use and helping law enforcement and professionals with daily tasks.checked 3 Oct 2026
- Base system
- The 64-bit distribution is based on Ubuntu 24.04.3 LTS and has a custom kernel based on version 6.19.10.checked 3 Oct 2026
- Deployment
- It can run in live mode, though its main goal is to be installed as a default forensics lab.checked 3 Oct 2026
- Licensing and warranty
- The project says Tsurugi Linux [LAB] and Tsurugi Acquire are free under the GNU General Public License and provided without warranty; some included tools are not open source.checked 3 Oct 2026
- Organization
- The project says it is independent, has no commercial brand or company behind it, and is developed in the team's free time.checked 3 Oct 2026
- Other features
- It includes a Computer Vision analysis section and an OSINT profile switcher.checked 3 Oct 2026
- Purpose
- Tsurugi Linux is a customized distribution for digital forensics, incident response, malware analysis, and OSINT.checked 3 Oct 2026
- Related toolkit
- Bento is a portable toolkit with over 300 applications for live forensics and incident response on Windows, Linux, and macOS.checked 3 Oct 2026
- Security verification
- The downloads page recommends checking hashes and downloading the project's PGP public key to verify signatures.checked 3 Oct 2026
- Support
- The FAQ says project questions are usually answered by email within 24 to 48 hours, while basic questions unrelated to the project are no longer answered.checked 3 Oct 2026
- Updates
- Tsurugi Linux [LAB] retrieves updates from official Ubuntu repositories; the FAQ warns that dist-upgrade can break the OS.checked 3 Oct 2026
- Write blocking
- It includes device write blocking at the kernel level.checked 3 Oct 2026
The company
- Founded
- 2018checked 28 Sep 2026
Alternatives to Tsurugi Linux
- 1
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 2
Plaso
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 3
CAINE
Free planOpen sourceLinuxSelf-hostedWindows7.1Free plan - 4
Paraben E3 Forensic Platform
AndroidiOSLinuxmacOS7.1From $699 a year - 5
OSForensics
Free planAndroidSelf-hostedWindows7.0From $945 a year - 6
NetworkMiner
Free planLinuxmacOSWindows6.9$1,300 one-time