This overview brings together all the questions and answers relating to Linux forensics on LanCologne – from file systems and system logs, through to containers, Server services and security incidents, right up to forensic methodology, tools and the legal framework. Click on a category to view the relevant questions.
File systems, volumes and encryption
- Forensic analysis of the ext4 file system – the basis for most Linux investigations
- Forensic analysis of the ext4 journal – reconstructing write operations and system states
- Forensic analysis of the XFS file system – Accurately analysing a high-performance file system on Servern
- Forensic analysis of the Btrfs file system – properly evaluating copy-on-write structures
- Forensic analysis of Btrfs snapshots – Reconstructing specific historical system states
- Forensic analysis of ZFS on Linux – evaluating pool structures and integrity mechanisms
- Forensic analysis of ZFS snapshots – Reconstructing previous datasets in a traceable manner
- Forensic analysis of LVM – Correctly classifying logical volumes
- Forensic analysis of LVM snapshots – Evaluating historical volume states
- Forensic analysis of software RAID (mdadm) – correctly reconstructing arrays
- Classifying LUKS encryption in a forensic context – Correctly assessing encrypted Linux volumes
- Forensic analysis of a swap partition – analysing the contents of the swap file
- Forensic classification of tmpfs and RAM-based file systems – Correctly assessing volatile memory areas
- Forensic recovery of deleted files on ext4 – possibilities and limitations of reconstruction
- Forensic analysis of the inode structure – using metadata as a key forensic source
- Forensic analysis of extended attributes (xattr) – Additional metadata beyond standard attributes
- Forensic analysis of OverlayFS – Correctly analysing layered file systems
- Forensic analysis of partition tables (GPT/MBR) under Linux – Reconstructing the basic disk structure
- Forensic classification of deleted files on Btrfs and XFS – specifically taking into account the differences compared to ext4
- Forensic analysis of encrypted LVM volumes – handling LUKS and LVM correctly in combination
- Forensic acquisition of encrypted LUKS volumes
System logs and audit
- Forensic Analysis of systemd-journald Logs – The Central Log Source for Modern Linux Systems
- Forensic correlation of journalctl output – linking system events by time and content
- Forensic analysis of auditd logs – Evaluating rule-based system monitoring
- Forensic analysis of syslog artefacts – analysing traditional text logs
- Forensic analysis of rsyslog configuration – correctly assessing the scope of logging
- Systematically analysing the /var/log directory from a forensic perspective – comprehensively capturing the central log collection
- Forensic analysis of the kernel ring buffer (dmesg) – Reconstructing early system events
- Forensic analysis of load and load log records – Evaluating login histories in a traceable manner
- Forensic analysis of wtmp and utmp files – analysing session data in detail
- Forensic analysis of a btmp file – analysing failed login attempts
- Forensic analysis of SELinux audit logs – evaluating Mandatory Access Control events
- Forensic analysis of AppArmor logs – evaluating profile-based access controls
Autostart, kernel and process analysis
- Forensic Analysis of systemd Units and Services – Persistence Mechanisms in Modern Linux Systems
- Forensic analysis of cron jobs – systematically examining scheduled tasks
- Forensic analysis of systemd timers – Evaluating a modern alternative to traditional cron
- Forensic analysis of init.d scripts – Checking traditional system boot mechanisms
- Forensic identification of autostart mechanisms in Linux – An overview of all relevant persistence methods
- Forensic analysis of udev rules – examining device management as a source of persistence
- Forensic analysis of kernel modules – checking extensions to kernel functionality
- Detecting LD_PRELOAD Manipulations Through Forensic Analysis – Uncovering Manipulation of Dynamic Libraries
- Forensic detection of rootkits on Linux – uncovering deeply embedded compromises
- Forensic analysis of the process list and /proc – evaluating a system’s runtime state
- Correlating running processes forensically with persistence mechanisms – From runtime state to permanent embedding
- Forensic analysis of systemd sockets – checking event-driven activation of services
User accounts, the shell and authentication
- Forensic analysis of PAM configuration – correctly classifying authentication modules
- Forensic analysis of Linux user accounts – reconstructing accounts, groups and permissions
- Forensic analysis of /etc/passwd and /etc/shadow – Examining central account databases in detail
- Forensic analysis of sudo logs – understanding privilege escalation in detail
- Forensic analysis of SSH authentication protocols – reconstructing remote access sessions in a traceable manner
- Forensic analysis of SSH known hosts and keys – reconstructing trust relationships between systems
- Forensic analysis of the Bash history – the command-line history as a key forensic source
- Forensic analysis of Zsh history – Evaluating advanced shell logging
- Forensic analysis of Shell environment variables – assessing the configuration context of individual sessions
- .Forensic analysis of .bashrc and profile files – examining shell initialisation as a source of persistence
- Systematically analysing home directories using forensic methods – comprehensively capturing user-related data
Containers and virtualisation
- Forensic analysis of Docker containers – Conducting a forensically traceable assessment of containerised environments
- Forensic analysis of Docker images – tracing the origin and contents of container images
- Forensic analysis of Docker volumes – Forensic examination of persistent container data
- Forensic analysis of Kubernetes cluster artefacts – Forensic investigation of orchestrated container environments
- Forensic analysis of Podman containers – Forensic investigation of daemonless container environments
- Forensic analysis of LXC/LXD containers – conducting a forensically traceable examination of system containers
- Forensic analysis of KVM/QEMU virtualisation – Forensic examination of virtual machines running on Linux
- Forensic analysis of VMware on Linux – Investigating VMware virtualisation environments on Linux
- Forensic analysis of VirtualBox on Linux – Forensic examination of VirtualBox environments on Linux
- Forensic analysis of Cloud Init configuration – Forensic investigation of automated system initialisation
- Forensic backup of AWS EC2 Linux instances – Backing up and analysing cloud instances in a forensically traceable manner
- Performing a forensic backup of a Kubernetes node
Server – Network and Packet Management
- Forensic analysis of network configuration under Linux – reconstructing interfaces and routing in a traceable manner
- Forensic analysis of iptables/nftables rules – checking firewall configuration and whether it has been tampered with
- Forensic reconstruction of network connections (ss/netstat) – Analysing active and historical connections
- Forensic analysis of the DNS cache and resolver configuration – using name resolution as a forensic lead
- Forensic analysis of NetworkManager artefacts – evaluating connection profiles and history
- Forensic analysis of VPN configurations on Linux – Classifying encrypted tunnel connections
- Forensic analysis of APT package manager logs – evaluating the installation and change history of Debian-based systems
- Forensic analysis of dpkg logs – evaluating package status and installation details
- Forensic analysis of RPM/YUM/DNF logs – evaluating package management on RPM-based distributions
- Forensic analysis of Python virtual environments – Forensic investigation of isolated runtime environments
- Forensic analysis of Apache web server logs – systematically evaluating access and error logs
- Forensic analysis of Nginx web server logs – analysing access logs from this widely used web server
- Forensic analysis of MySQL/MariaDB databases – Forensic reconstruction of database accesses and changes
- Forensic analysis of a PostgreSQL database – Forensic evaluation of transaction history and accesses
- Forensic analysis of Postfix mail server logs – Forensic reconstruction of email delivery and traffic
- Forensic analysis of Samba shares – analysing network shares between Linux and Windows
- Forensic analysis of NFS shares – Forensic reconstruction of Network File System accesses
- Forensic analysis of Elasticsearch/Log-Server artefacts – Forensic evaluation of the central logging infrastructure
Desktop, browser and user traces
- Forensic analysis of GNOME desktop artefacts – using the desktop environment as a source of forensic evidence
- Forensic analysis of browser history on Linux – reconstructing the web usage of Linux users
- Forensic analysis of Thunderbird profiles – analysing email client data on Linux
- Forensic analysis of the Trash/Recycle Bin – Recovering supposedly deleted files on Linux
Security incidents and intrusion detection
- Detecting web shells on Linux-Servern – Forensically identifying malicious Server scripts
- Detecting cryptomining malware on Linux systems – providing forensic evidence of unauthorised resource usage
- Forensic reconstruction of reverse shells – Forensic detection of outbound remote access by attackers
- Forensic analysis of Linux ransomware – reconstructing encryption attacks on Linux systems
- Forensic evidence of SSH brute-force attacks – Providing forensic evidence of systematic login attempts
- Proving privilege escalation through forensic analysis – reconstructing unauthorised expansion of privileges
- Detecting log manipulation and anti-forensics – uncovering evidence tampering on Linux systems
- Forensic backup of volatile memory (RAM) under Linux – Capturing transient data from a running system
Forensic methodology, tools and data preservation
- Forensic analysis of atime/mtime/ctime timestamps – Interpreting file system timestamps correctly
- Forensic evaluation of NTP synchronisation – verifying time accuracy as the basis for forensic timelines
- Using checksums and integrity mechanisms in a forensic context – cryptographically verifying file integrity
- Forensic analysis of immutable flags and chattr attributes – Evaluating advanced file system protection attributes
- Backing up a running Linux system (live backup)
- Performing an on-site forensic backup of a physical Linux Server system
- Performing a forensic backup of a Linux laptop
- Analysing Linux file systems with X-Ways Forensics
- Analysing Linux artefacts with Belkasoft X
- Autopsy timeline analysis for Linux systems
- X-Ways Forensics Hex Analysis for Linux file systems
- Belkasoft X Case Management for Linux Investigations
- Write protection and write blockers in Linux backups
- Chain of Custody in Linux Forensic Investigations
- The difference between live and post-mortem analysis in Linux
- Hash calculation and verification for Linux backups
- Creating Linux disk images correctly (dd/dc3dd/Guymager)
- Sparse images and Linux forensics
- Forensic cloning of large Linux storage media
- Creating a timeline for Linux systems (Super-Timeline)
- Carving deleted files on Linux file systems
Law, Quality and Cooperation
- Performing a remote forensic backup on a Headless Linux Server
- Automated versus manual Linux forensic analysis
- Reporting and the preparation of expert reports in Linux investigations
- Remote forensics in distributed Linux infrastructures
- Linux forensics in the context of PCI DSS audits
- Linux forensics in the context of GDPR incident investigation
- Linux Forensics for Legal Reports
- Collaboration with IT departments in the event of Linux incidents
- Emergency support and incident response contracts for Linux infrastructure
- Quality assurance and the dual-control principle in Linux forensics
- Why Linux forensics requires multiple tools and manual checks
Other questions
- Performing a forensic backup of a software RAID system
- Performing a forensic backup of a Linux-based NAS system
- Performing a forensic backup of an embedded Linux device
- Performing a forensic backup of a Raspberry Pi
- Performing forensic backups of Linux-based routers and firewalls
- Performing forensic backups of IoT devices running the Linux operating system
- Performing a forensic backup of a Linux cloud instance (across providers)
- Forensic backup of a Linux system with Secure Boot
- Forensic backup of an SSD under Linux
- Performing a forensic backup of a Linux system following a system crash
- Forensic backup of a Linux/Windows dual-boot system
- Performing a forensic backup of the Linux-Server in the data centre
- Performing a forensic backup of an air-gapped Linux system
- Performing a forensic backup of a Linux mail server infrastructure
- Performing a forensic backup of a Linux database server
- Performing a forensic backup of a Linux firewall appliance
- Forensic backup of network storage (SAN) running Linux
- Forensic backup of a Linux system without a known password
- Performing a forensic backup of multiple Linux Server devices in a cluster
- Carrying out a Linux forensic analysis using The Sleuth Kit and Autopsy