This study aims to analyze the impact of Monti ransomware infection on Linux operating systems through a digital forensic approach based on artefacts and metadata. The investigation was conducted in an isolated laboratory environment using physical hardware, employing RAM acquisition and disk imaging methods on two system states: before and after infection. The ransomware execution was triggered by the monti.elf binary located in the temporary /tmp direktori, initiating encryption of operational files within the /Documents direktori. The analysis utilized Sleuthkit tools, focusing on file system structures, inode metadata, timestamps, and artefact distribution. Findings indicate that Monti employs an in-place encryption technique, replacing file contents without altering inode or block location. Key artefacts identified include encrypted files (.puuuk, .monti), ransom notes (readme.txt), execution logs (result.txt), and the ransomware binary (monti.elf). All artefacts share identical timestamps, suggesting automated execution within a single session. Validation was performed through comparative analysis of clean and infected systems, entropy measurements, and examination of TOR-based communication structures embedded in the ransom notes. These findings confirm that Monti operates as part of a Ransomware-as-a-Service (RaaS) ecosystem, with a structured and efficient infection pattern. This research contributes to the mapping of Monti ransomware artefacts and the development of forensic investigation methodologies tailored for Linux environments.