About This Tool

Automation and Scaling of Digital Forensics Tools

Primary Use Case

Turbinia is primarily used by incident responders and digital forensic analysts to automate the processing of large volumes of forensic evidence, especially in cloud or hybrid environments. It helps reduce response time by parallelizing forensic tool execution and managing distributed workloads efficiently.

Key Features

Automates running of common forensic tools like Plaso and The Sleuth Kit (TSK)
Scales forensic processing workloads in cloud, local, or hybrid environments
Distributes and parallelizes evidence processing tasks to reduce response time
Uses Celery for task scheduling and Kombu for messaging between client and server
Supports continuous worker processes that handle forensic tasks dynamically
Feeds newly discovered evidence back into the processing pipeline for further analysis
Provides a client-server-worker architecture for flexible deployment
Open-source and extensible framework for digital forensics automation

Insights & Recommendations

Turbinia is currently in Alpha release and is in maintenance mode with no new features planned; users are encouraged to consider OpenRelik for future projects. It requires a messaging backend (Kombu) and task scheduler (Celery) to operate. Proper configuration of server, API server, and workers is essential for distributed processing. Best suited for cloud or hybrid environments where scaling forensic workloads is necessary.

Installation

Follow the installation guide at https://turbinia.readthedocs.io/en/latest/user/install.html
Install turbinia-client via pip: pip install turbinia-client

Usage

turbiniactl server

Starts the Turbinia server component

turbiniactl api_server

Starts the Turbinia API server component (required when using Celery)

turbiniactl celeryworker

Starts one or more Turbinia worker processes to execute forensic tasks

turbinia-client submit ${evidencetype}

Submits evidence of a specified type to Turbinia for processing

turbinia-client status

Checks the status of running forensic processing tasks

turbinia-client -h

Displays help and usage information for the Turbinia client

Smart Usage Notes

Integrate Turbinia with SIEM platforms to automate forensic evidence ingestion and accelerate incident investigation workflows.Leverage Turbinia's cloud scalability to handle large-scale forensic data during enterprise-wide incident response.Use Turbinia as part of purple team exercises to simulate rapid evidence collection and analysis under attack scenarios.Extend Turbinia with custom forensic modules to tailor automation for specific organizational environments or threat models.Combine Turbinia with threat hunting tools to automate discovery and processing of suspicious artifacts across distributed endpoints.

OpenSec Atlas

turbinia