IT Forensics · Linux
Forensic analysis of the process list and /proc – evaluating a system’s runtime state
The virtual /proc file system provides runtime information on processes, network connections and system states in Linux. It exists solely in main memory and is tied to the running system.
As /proc information is lost when a system is shut down, its forensic analysis is only possible by capturing data ‘live’ from a system that is still running, or via a separately backed-up memory dump.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.
Our services
For running systems, we collect relevant /proc information, such as process lists, open files and network connections, and map this to the corresponding executable files and persistence mechanisms.
Typical areas of application
This is how a /proc analysis works
Whilst the system is still running, relevant /proc information is specifically collected, including the list of processes, associated command lines, open files and network connections. This information is then cross-referenced with persistent artefacts, such as autostart configurations, to distinguish between expected and unexpected processes.
Why is the /proc analysis relevant from a forensic perspective?
Certain attack techniques leave no permanent traces on the file system, but exist solely in the memory of a running process. Such activities can only be detected through live monitoring.
As /proc data is lost along with the system state, the decision for or against live data collection is one of the most important early decisions to be made in an investigation.
Frequently Asked Questions
LanCologne – Linux Forensics Cologne
Do you require a professional forensic investigation into „process lists and forensic analysis of /proc"? LanCologne can assist you with the legally admissible preservation of digital evidence and the transparent analysis of relevant Linux artefacts.
Related to this topic
- Correlating running processes forensically with persistence mechanisms – From runtime state to permanent embedding
- Forensic analysis of systemd sockets – checking event-driven activation of services
- Forensic Analysis of systemd Units and Services – Persistence Mechanisms in Modern Linux Systems
- Forensic analysis of cron jobs – systematically examining scheduled tasks