Documentation Tsurugi Acquire

Tsurugi Acquire (first release 03/Nov/2018 at AvTokyo security conference in Japan) is a lightweight and streamlined version of Tsurugi Linux [LAB], aimed at providing the basic tools needed to boot a PC and acquire mass storage devices. For this reason the installer has been deleted and it runs only in live mode.

A small subset of tools is installed to make the whole ISO smaller and its main purpose is to easily reside in RAM, be fast at boot and support as many architectures as possible.

This Linux distribution it's based on Debian 10 with a patched kernel 5.11.6 that is at 32 bits to grant more compatibility and easily run on oldest devices.

A Write Blocker system has been enforced at kernel level to avoid device write access and integrity alteration.

Automatic set HI-DPI zoom for high screen resolution with more than 2560 pixels. There is an option, inside graphics menu, where you can switch to the original screen resolution.

In live mode, during the boot phase, it's possible to disable specific graphic drivers in case of visualization problems or potential crashes

A Mouse keys switch function has been added to easily move the mouse pointer with only the keypad if needed. The on/off button is available on the Desktop

Automatic SSH keys generation for security reasons, to avoid sharing the same SSH secret keys in all downloaded ISO files, an automatic process during the boot phase is in charge of making unique SSH server keys

touchpad_toggle button to quickly disable/enable laptop touchpad, particularly useful when touchpad key is not present or not detected

The Tsurugi Acquire default user is “root” and the password has been voluntarily left blank.

“TSURUGI Linux - the sharpest weapon in your DFIR arsenal”