IT Forensics · Linux

Forensic analysis of RPM/YUM/DNF logs – evaluating package management on RPM-based distributions

On RPM-based distributions such as Red Hat Enterprise Linux, CentOS, Rocky Linux or Fedora, RPM and the tools built upon it – YUM and DNF respectively – handle package management, whilst logging installation and modification processes.

Enquire without obligation

As with Debian-based systems, these logs can be used to trace the software history of a system over time, although the specific log format varies depending on the tool used.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We analyse the existing RPM, YUM and DNF logs, reconstruct the installation history of relevant packages and place them within the chronological context of the investigation.

Typical areas of application

Verifying the installation of specific software on RPM-based systems
Reconstruction of packages that have subsequently been removed
Investigation into automated package installations as part of an attack
Aligning the software history with other timeline events
Incident Response on Linux Systems
Judicial and non-judicial expert reports

This is how an RPM/YUM/DNF analysis works

Once the backup has been completed, the existing RPM database contents and the YUM and DNF log files are collected and analysed. Installation, Update and removal operations are organised chronologically and cross-referenced with other system artefacts.

Why is RPM/YUM/DNF analysis relevant in a forensic context?

Even on RPM-based systems, the installation of certain tools can be a key component in reconstructing the sequence of an attack, although the precise timestamps from the logs are crucial for this.

As business-critical Server systems are frequently run on RPM-based distributions, a reliable reconstruction of the software history is often of particular economic importance.

Frequently Asked Questions

Which RPM-based distributions are widely used?+
These include, amongst others, Red Hat Enterprise Linux, CentOS, Rocky Linux, AlmaLinux and Fedora, which are similar in terms of their underlying protocol structure.
What is the difference between YUM and DNF?+
DNF is the more modern successor to YUM, with improved dependency management, but both log similar operations.
Can RPM packages that have been installed manually also be detected?+
Yes, RPM packages installed directly are also recorded in the RPM database and can be analysed accordingly.

LanCologne – Linux Forensics Cologne

Do you require a professional forensic investigation into „forensic analysis of RPM/YUM/DNF logs"? LanCologne can assist you with the legally admissible preservation of digital evidence and the transparent analysis of relevant Linux artefacts.

Get in touch now