Blue Team Handbook: Incident Response

Chapter 6. Linux Volatile Data System Investigation

In the fields of observation, chance favors only the prepared mind.

Louis Pasteur

Luck favors the prepared.

Edna Mode

This chapter covers widely accepted processes and commands to run, in the approximate best order possible, for Unix and Linux systems. Remember that volatile data, such as memory, processes, and network ports, changes frequently. It may be wise to re-execute some of these commands throughout an incident, perhaps hourly. Command text output collected on a Linux system is not compatible with Windows because of carriage return line feed translation.

If you are going to review data on a Windows system, you can convert the data from Unix or Linux format to Windows format with the Unix/Linux dos2unix command.

As an incident responder, be aware of the major areas to investigate on a Linux system: network connections, processes, configuration files normally found in /etc, the filesystem, user home directories and the myriad .dot files in them, and /var/log contents.

Preparation

Several steps are involved in preparing to handle an incident on a Linux platform, as discussed in this section.

Linux Distributions

Linux itself refers to the kernel, not the packaged operating system and its supporting toolset. The distribution refers to the GUI, package management tool, log locations, and basic software loadout. Two main categories influence the skills needed to analyze a system: Debian-based distros, which include ...