Documentation Tsurugi Acquire

Tsurugi Acquire (first release 03/Nov/2018 at AvTokyo security conference in Japan) is a lightweight and streamlined version of Tsurugi Linux [LAB], aimed at providing the basic tools needed to boot a PC and acquire mass storage devices. For this reason the installer has been deleted and it runs only in live mode.

A small subset of tools is installed to make the whole ISO smaller and its main purpose is to easily reside in RAM, be fast at boot and support as many architectures as possible.


This Linux distribution it's based on Ubuntu 16.04 LTS with a patched kernel 4.18.5 as well as Tsurugi Linux main distro but the kernel it's 32 bit to grant more compatibility and easily run on oldest devices.


A Write Blocker system has been enforced at kernel level to avoid device write access and integrity alteration.

Automatic set HI-DPI zoom for high screen resolution with more than 2560 pixels. There is an option, inside graphics menu, where you can switch to the original screen resolution.

In live mode, during the boot phase, it's possible to disable specific graphic drivers in case of visualization problems or crashes.


The Tsurugi Acquire default user is “root” and the password has been voluntarily left blank.

“TSURUGI Linux - the sharpest weapon in your DFIR arsenal”