Abstract:UNIX is one of the most popular operating systems, it has great practical significance to research the methodology of UNIX forensic analysis. This paper firstly introduces the method to capture the volatile data from UNIX systems, then introduces the concrete steps and method of UNIX forensic analysis.