Practical Cyber Intelligence

8Linux Forensics

Linux, an open-source operating system, has gained popularity in recent years as it has become more user-friendly and provides greater control over the system. Because of the open-source nature of Linux, there exist numerous distributions, but this guide will focus on Debian.¹ While different distributions have some variations in package management and configuration or log file locations, their forensic analysis processes are very similar.

When comparing Windows and Linux forensics, the acquisition process is the same, using tools like FTK Imager to create a physical copy of the disk. The main difference lies in the locations of the evidence. Although Windows has a centralized registry system for user and configuration activities, Linux stores configuration information in individual files at different locations.

One of the considerations when dealing with Linux systems is that, in many of the cases, the users have better technical skills compared to the average user, making them potentially more adept at hiding their tracks and using encryption. However, even skilled users occasionally overlook security measures, or simply human laziness leaving the system insecure allowing us to extract information from the system.

To effectively analyze a Linux system, you should familiarize yourself with the nuances of the operating system, including key evidence locations and the unique challenges presented by different distributions.

8.1 File System

Linux file systems ...