Orin – Offline Linux Forensics for Air‑Gapped Environments

Orin is a production‑ready, offline‑first forensic snapshot platform for Linux. It collects system state (processes, network, kernel modules, FIM, eBPF, etc.), signs evidence cryptographically, and provides a local dashboard and a multi‑tenant fleet hub – all without any internet connection or cloud dependencies.

Why Orin exists
Most security tools require a persistent agent, a cloud backend, or constant network access. That’s impossible in air‑gapped SCIFs, classified networks, ICS/SCADA, or compliance‑driven environments. Orin was built from day zero to work completely offline – no telemetry, no phone‑home, no surprises.

What you get when you sponsor

• 🛡️ Peace of mind – You help maintain a critical tool for DFIR professionals working in sensitive environments.
• 📜 Your name on the sponsor wall (if you wish) in the project README.
• 🗣️ Priority input on future features (for $25+/month sponsors).
• 💼 Commercial licensing & support – Companies that need to embed Orin or get SLA‑backed support can also purchase a commercial license (see wiki).

Where the money goes

• $50/month covers domain name, testing hardware (e.g. Raspberry Pi for ARM64 tests), and the occasional coffee.
• $200/month allows me to dedicate a full day each week to bug fixes, documentation, and community support.
• $1,000+/month would let me work on Orin part‑time and accelerate the roadmap (offline updates, PostgreSQL backend, Windows agent feasibility).

Current status
Orin v1.2.0 is production‑capable – used by incident responders and compliance auditors. Over 1,000 tests, 85% coverage, and full documentation. The project is stable and actively maintained.

Thank you for considering supporting open‑source security. Every sponsor, no matter the tier, means the world to me.

– Musa (jaradat13)