analyzing-linux-system-artifacts

1# Analyzing Linux System Artifacts
2 
3## When to Use
4- When investigating a compromised Linux server or workstation
5- For identifying persistence mechanisms (cron, systemd, SSH keys)
6- When tracing user activity through shell history and authentication logs
7- During incident response to determine the scope of a Linux-based breach
8- For detecting rootkits, backdoors, and unauthorized modifications
9 
10## Prerequisites
11- Forensic image or live access to the Linux system (read-only)
12- Understanding of Linux file system hierarchy (FHS)
13- Knowledge of common Linux logging locations (/var/log/)
14- Tools: chkrootkit, rkhunter, AIDE, auditd logs
15- Familiarity with systemd, cron, and PAM configurations
16- Root access for complete artifact collection
17 
18## Workflow
19 
20### Step 1: Mount and Collect System Artifacts
21 
22```bash
23# Mount forensic image read-only
24mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/linux_evidence.dd /mnt/evidence
25 
26# Create collection directories
27mkdir -p /cases/case-2024-001/linux/{logs,config,users,persistence,network}
28 
29# Collect authentication logs
30cp /mnt/evidence/var/log/auth.log* /cases/case-2024-001/linux/logs/
31cp /mnt/evidence/var/log/secure* /cases/case-2024-001/linux/logs/
32cp /mnt/evidence/var/log/syslog* /cases/case-2024-001/linux/logs/
33cp /mnt/evidence/var/log/kern.log* /cases/case-2024-001/linux/logs/
34cp /mnt/evidence/var/log/audit/audit.log* /cases/case-2024-001/linux/logs/
35cp /mnt/evidence/var/log/wtmp /cases/case-2024-001/linux/logs/
36…