IT Forensics · Linux

Correlating running processes forensically with persistence mechanisms – From runtime state to permanent embedding

A complete forensic picture can only be obtained by comparing a system’s current runtime state with its permanently configured persistence mechanisms. For example, a running, inconspicuous process may be attributable to an undetected autorun entry.

Enquire without obligation

Conversely, an existing persistence mechanism may be inactive at the time of the investigation, for example because it is scheduled to run at a later date. The two perspectives therefore complement one another.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We systematically cross-reference runtime information retrieved from /proc with identified persistence mechanisms such as Cron, systemd units and autostart configurations in order to determine the origin and trigger of each relevant process.

Typical areas of application

•Identifying the cause of abnormal running processes
•Linking runtime state and configuration analysis
•Investigation into time-triggered malware
•Creation of a complete persistence and runtime profile
•Incident Response on Linux Systems
•Judicial and non-judicial expert reports

This is how the correlation between processes and persistence works

Once runtime information and persistence configurations have been collected, both data sources are systematically compared. For each process that stands out, the system checks whether there is a corresponding autostart, cron or service entry. For each identified persistence mechanism, the system checks whether a corresponding process is active or scheduled to run at a later time.

Why is this correlation relevant in a forensic context?

Looking at either the runtime state or the configuration files in isolation can only provide a partial picture of the actual situation. It is only by combining the two that a complete picture emerges.

This method also helps to pinpoint the cause of unexplained processes, rather than leaving them unassessed as mere anomalies.

Frequently Asked Questions

Why is the list of proceedings alone not sufficient?+
Because it only shows the current status, but not how or why a process was started, or whether it would be restarted.
What does a process without an apparent persistence mechanism mean?+
This may indicate that the action was carried out manually, that there is a mechanism as yet unidentified, or that it was a deliberate attempt to conceal the facts, and is being investigated separately.
Is this correlation analysed for every case?+
If a breach or unauthorised activity is suspected, it is a standard part of a thorough investigation.

🔗 Related topics

LanCologne – Linux Forensics Cologne

Do you require a professional forensic investigation into „correlating running processes with persistence mechanisms"? LanCologne can assist you in securing digital evidence in a manner that stands up in court, as well as in the traceable analysis of relevant Linux artefacts.

Get in touch now