jq is super useful, once somebody explains the basics to you. Here I am explaining the basics in a way that's applicable for all you DFIR types.

https://righteousit.com/2026/04/06/jq-for-forensics/

#JSON #DFIR #Linux

jq For Forensics

jq is a great tool for parsing JSON data. But DFIR professionals often apply jq differently from the typical examples you see written for developers.

Righteous IT
@hal_pomeranz I don't use jq a lot, but when I do, it's absolutely the right tool. Such a cool tool.
@cR0w I’ve been dealing with a lot of JSON data lately and learning a lot about jq. It’s a different mindset than other tools I use and it took a while to get comfortable with it.
@hal_pomeranz @cR0w I agree! It feels like a fundamentally different programming paradigm, compared to the usual ones (procedural, object-oriented, event-driven/asynchronous, etc.). I actually think I've learned quite a bit from writing complex programs in jq. (arguably more complex than should be written in jq, but it was fun)