Linux

Notable reference site: Linux LEO, The Law Enforcement and Forensic Examiner’s Introduction to Linux. Please note, the guide has just received its first update in over a year. Updates should be coming more regularly, according to the guide’s author. Stay tuned for more to come! 

Test data is available GPT Partition Image (gptimage.raw.gz), Fat File System Image (fat_fs.raw), “Able2” Ext2 Disk Image , able2.tar.gz), “Able3” Ext4 Disk Image (able_3.tar.gz), Practice Log Archive (logs.v3.tar.gz), Carve Image (image_carve_2017.raw), and NTFS Image (ntfs_Pract_2017_E01.tar.gz).

For information on file signature analysis (OS agnostic and file-type specific), please check out Gary Kessler’s File Signature Table. 

See below for a list of Linux Tools.

Tool	Description
lLeapp	Linux Logs Events Application Program Parser
UAC	UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
Unix Collector	A shell script for basic forensic collection of various artifacts from UNIX systems.

See below for a list of Linux Artifacts.

Artifact or Process	Resource
Atop	Parsing Atop log files with Dissect
Discord	Finding Discord chats in Linux - #DFIR review
Image Mounting	Mounting E01 Forensic Images in Linux - Eric Capuano
Ivanti Evidence Acquisition	Overview: Evidence Collection of Ivanti Connected Secure Appliances
Ivanti Log Analysis	Ivanti Connect Secure Auth Bypass and Remote Code Authentication CVE-2024-21887
Linux Forensics	A Linux Forensics Starter Case Study
Linux Forensics	Performing Linux Forensic Analysis and Why You Should Care!
Linux Forensics	Detecting and Investigating OpenSSL Backdoors on Linux
Linux Forensics	Linux Web Server Forensics: Dr. Ali Hadi's Web Server Case
Linux Forensics	Linux Forensics In Depth
Linux Forensics	Investigating a Compromised Web Server
Linux Forensics	Linux Incident Response - using lsof to check network connections
Linux Forensics	Linux Live Incident Response - the ps command
Linux Forensics	Linux incident response - understanding endianess
Linux Forensics	Linux Incident Response - getting the EXT4 file creation time
Linux Forensics	Linux Forensic Artifacts
Linux Forensics	Using the Unix-like Artifacts Collector and Cado Community Edition to Investigate a Compromised Linux System
Linux Forensics	Understanding nohup
Linux Forensics	Linux Copy on Write for Incident Responders
Linux Forensics	Orphan Processes in Linux
Memory Acquisition	AArch64 Memory Acquisition for Linux
Memory Forensics	AVML – Memory Forensics For Linux
Memory Forensics	Acquiring Linux Memory using AVML and Using it with Volatility
Memory Forensics	Linux Forensics Series Chapter 1 — Memory Forensics
Memory Forensics	Microsoft's Project Freta
Memory Forensics	Intro to Linux memory forensics
Memory Forensics	Linux Forensics: Memory Capture and Analysis
Memory Forensics	How to extract forensic artifacts from Linux swap
TestDisk	TestDisk in Linux and recover deleted files
Timestamps	Linux History File Timestamps - Thomas Millar
Universal Serial Bus (USB)	13Cubed - Linux Forensics! First Look at usbrip
Universal Serial Bus (USB)	USB Forensics
Universal Serial Bus (USB)	USB 101
Velociraptor	Velociraptor - Dig Deeper