IT Forensics · Linux

Forensic analysis of dpkg logs – evaluating package status and installation details

dpkg is the underlying package management tool on Debian-based systems, on which APT is also based, and maintains its own, more detailed logs of installed packages and their status.

Enquire without obligation

Whilst APT protocols tend to document the actions that trigger events, dpkg also provides a detailed set of status data from which the exact installation status of individual packages can be determined.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We analyse the dpkg status database and associated logs to determine the exact installation status of individual packages and to correlate this with other findings.

Typical areas of application

Determining the exact installation status of individual packages
Supplementing and verifying APT protocol findings
List of installed package versions at a specific point in time
Analysis of manually installed packages not obtained via repositories
Incident Response on Linux Systems
Judicial and non-judicial expert reports

This is how a dpkg analysis works

Once the backup has been completed, the dpkg status database is read and compared with the supplementary log files. Any unusual packages or those installed manually that were not obtained from the configured default repositories are checked separately.

Why is the dpkg analysis relevant from a forensic perspective?

Detailed package status information can provide insight into exact version numbers, which may be relevant, for example, when assessing known vulnerabilities at a specific point in time.

Packages installed manually, rather than from standard repositories, warrant particular attention, as they may provide a potential route for the introduction of malware.

Frequently Asked Questions

What is the difference between dpkg and APT?+
dpkg manages the actual package installation and the status database, whilst APT, as the overarching tool, resolves dependencies and manages repositories.
Can version histories be reconstructed for a specific point in time?+
With the relevant logs and timestamps, this is possible in many cases.
Are manually installed .deb packages also included?+
Yes, even packages installed manually are recorded in the dpkg status database.

LanCologne – Linux Forensics Cologne

Do you require a professional forensic investigation into „forensic analysis of dpkg logs"? LanCologne can assist you with the legally admissible preservation of digital evidence and the traceable analysis of relevant Linux artefacts.

Get in touch now