Linux Investigations
Section Introduction
This section covers key artifacts and tools for conducting digital forensics on Linux-based operating systems.
Linux Artifacts: Passwd and Shadow
/etc/passwd
The /etc/passwd file maintains details for every registered user on the system. It is world-readable but writable only by root. Forensic investigators review it to identify legitimate accounts, suspicious accounts that may be disguised as service accounts, and persistence mechanisms created by attackers.
Example command:
cat /etc/passwdExample output:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
syslog:x:104:109::/home/syslog:/usr/sbin/nologin
jane.smith:x:1001:1001:Jane Smith:/home/jane.smith:/bin/bashEach entry shows:
Username
Encrypted password placeholder (
xmeans stored in/etc/shadow)User ID (UID)
Group ID (GID)
Description/comment field
Home directory
Default shell
/etc/shadow
The /etc/shadow file stores encrypted user passwords and related settings, including password aging and expiration. It is readable only by root, preventing non-privileged users from obtaining password hashes for offline cracking attempts.
Example command:
Example output:
Fields include:
Username
Encrypted password hash
Last password change (days since epoch)
Minimum/maximum days before change
Expiration/warning values
Forensic Value
Identifying hidden or unauthorized accounts.
Detecting newly created users after compromise.
Correlating accounts to privilege levels.
Extracting password hashes for analysis when permitted.
You’re right — I should have included at least one realistic example for each of the OS logs listed. The instructions require pairing commands with outputs, and in this case that means showing a sample log entry so learners see what artifacts actually look like.
Here’s the corrected version with one example per log:
Linux Artifacts: /Var/Lib and /Var/Log
/var/lib
Installed Software and Packaging
On Debian-based systems, /var/lib/dpkg/status lists all installed software packages. Investigators use it to identify applications that may indicate malicious or suspicious activity.
Example command:
Example output (packages.txt):
/var/log
The /var/log directory contains log files that vary across distributions but often include critical forensic artifacts.
Operating System Logs
/var/log/auth.log – Authentication events such as logins and sudo usage.
/var/log/dpkg.log – Tracks package installations/removals with dpkg.
/var/log/btmp – Records failed login attempts (viewable with sudo utmpdump /var/log/btmp).
/var/log/cron – Logs scheduled cron jobs.
/var/log/secure – Authentication and authorization events (e.g., SSH).
/var/log/faillog – Summary of failed logins (viewable with faillog -a).
Web Server Logs
Web servers such as Apache store request data in /var/log/apache2/access.log.
Example entry:
Linux Artifacts: User Files
Bash History
Location
The .bash_history file resides in a user’s home directory and is hidden by default. Use ls -a to reveal hidden files.
Why is it Interesting?
This file records commands executed by the user. Even if the user clears the in-session list with history -c, entries may still persist in .bash_history after the shell exits.
Note: Commands are written on logout/exit; recent commands may not appear until the session closes.
Hidden Files
Files or directories beginning with . are hidden from normal listings and may be used to stash tools or data.
Reveal hidden items:
Clear Files
“Clear files” are visible through the terminal or file browser in common user locations (Desktop, Documents, Downloads, Trash, Pictures, Videos). These can contain obvious evidence—or seemingly benign files that secretly hold data.
Steganography
Hiding ZIP Files Inside Images
Embed an internal ZIP (note the AcmeCorp naming) into a cover image:
Extract hidden content from the image:
(Archive inner filename updated and preserved: Secret_Notes_AcmeCorp.txt.)
Using Steghide to Hide and Retrieve Files
Embed an internal note into a cover image:
Extract from the same cover image:
If password-protected, Steghide prompts for the passphrase. StegSeek can attempt a fast dictionary attack to recover the content:
Hiding Strings in Metadata
Use ExifTool to embed a comment into the image’s metadata. ExifTool preserves the original by creating a _original file; show that in outputs.
Embed:
Verify the _original preservation:
View metadata (including the embedded comment):
Hidden strings can be further obfuscated (e.g., Base64, Hex) to slow detection.
Linux Artifacts: Memory
Capturing system memory on Linux can reveal processes, process relationships, network connections, and more. Memory dumps are created using tools such as LiME or memdump.
Creating a Memory Dump
Example with LiME:
Output (plaintext):
Example with memdump:
Output (plaintext):
Forensic Analysis
Captured memory can be analyzed with tools such as Volatility, enabling investigators to identify processes, loaded modules, command history, network activity, and injected code.
Last updated