book

Practical Linux Forensics

by Bruce Nikkel

October 2021

Beginner to intermediate

400 pages

11h 15m

English

No Starch Press

Read now

Unlock full access

Why I Wrote This BookTarget Audience and PrerequisitesScope and OrganizationConventions and Format
Digital Forensics HistoryForensic Analysis Trends and ChallengesPrinciples of Postmortem Computer Forensic AnalysisSpecial Topics in Forensics

History of LinuxModern Linux SystemsLinux DistributionsForensic Analysis of Linux Systems
Analysis of Storage Layout and Volume ManagementFilesystem Forensic AnalysisAn Analysis of ext4An Analysis of btrfsAn Analysis of xfsLinux Swap AnalysisAnalyzing Filesystem EncryptionSummary
Linux Directory LayoutLinux File Types and IdentificationLinux File AnalysisCrash and Core DumpsSummary
Traditional SyslogSystemd JournalOther Application and Daemon LogsKernel and Audit LogsSummary
Analysis of BootloadersAnalysis of Kernel InitializationAnalysis of SystemdPower and Physical Environment AnalysisSummary
System IdentificationDistro Installer AnalysisPackage File Format AnalysisPackage Management System AnalysisUniversal Software Package AnalysisOther Software Installation AnalysisSummary
Network Configuration AnalysisWireless Network AnalysisNetwork Security ArtifactsSummary
Linux Time Configuration AnalysisInternationalizationLinux and Geographic LocationSummary
Linux Login and Session AnalysisAuthentication and AuthorizationLinux Desktop ArtifactsUser Network AccessSummary
Linux Peripheral DevicesPrinters and ScannersExternal Attached StorageSummary

Content preview from Practical Linux Forensics

2LINUX OVERVIEW

This chapter provides an overview of Linux for digital forensic investigators. It describes the history of Linux, including the significance and influence of Unix, and establishes the definition of “modern Linux” used throughout this book. I explain the role of the Linux kernel, devices, systemd, and the command line shell. I also provide examples of shell and command line basics, followed by a tour of various desktop environments and an overview of the birth and evolution of popular Linux distributions. The chapter concludes with a focus on digital forensics applied to Linux systems, especially in comparison to forensic analysis ...