LCL 28 - awk - Linux Command Line tutorial for forensics

Linux Command Line tutorial for forensics - 28 - awk

This video was made because of a request from viewer ColdBoot, thanks for your comments and suggestions!

Difficulty Level: Intermediate
Prerequisites: basic understanding of linux command line.
basic understand of program design - algorithms and process flow

In this video, we will look at the awk pattern scanning and processing language.

Video timeline
00:00 intro
00:15 awk syntax
02:50 Patterns
05:07 Action
09:52 Variables
13:56 Field Separator
15:31 BONUS: cyber security applications
20:49 recap

Linux distro:

Virtualization software:

🔨 For a more in-depth dive into awk:

This course was designed to provide information on how to use the command line environment in a Unix/Linux system to accomplish tasks such as imaging, data acquisition, and archiving. This course covers the basics of Unix/Linux commands that allow users to view and edit text files, obtain hardware and system information, partitioning and formatting, process related commands, manipulating disks and partitions, imaging, archiving, logical acquisition, live system response, and basic networking.

This would be beneficial for folks who are interested in digital forensics, incidence response, system administration, ethical hacking, or just plain linux. This course covers material for beginners as well as for advanced users. This course would also be helpful if you are considering taking the CompTIA Linux+ certification test.

DISCLAIMER: Links in this video description might be affiliate links. If you purchase a product or service using one of these links, I may receive a small commission at no additional cost to you. Thank you!

[bhupenderbhardwaj]

Loved the Video, 👌 Bonus section helped in understanding Practical usecases of Awk !!

[mikehettinga]

Now I actually understand the potential of awk. Thank you again. You are becoming my online tutor

[mohithts]

Excellent tutorial!, Thanks a lot man!!

[dxmajrd]

how do you add a count footer when testing for '$5 > 1000'? for me, NR-1 just gives the total number of records -1 not the filtered count. Tried to fit 'wc -l' in there but couldn't make it work.