Join the crusade!
Forensic images of Linux systems derived from a common "master" image can cause problems for investigators. Linux refuses to mount an image if the LVM UUIDs in the image are the same as an already mounted image. We can use a write cache created by the xmount program to change these UUIDs without impacting the original image files.… Continue reading Workaround For Duplicate LVM Names →
What did I actually do to create our Linux forensic scenario. This installment is the attacker's view of the process.… Continue reading Linux Investigation (Part 4) →
Wrapping up our Linux investigation. Memory and timeline analysis to answer some lingering questions.… Continue reading Linux Investigation (Part 3) →
Digging into our Linux investigation with memory analysis. Suspicious process details revealed!… Continue reading Linux Investigation (Part 2) →
Analyzing a Linux DFIR scenario. In Part 1 we find a possible rootkit and tie its appearance to a recent SSH session seen in the system logs.… Continue reading Linux Investigation (Part 1) →
An intro to running multiple Volatility plugins via volshell in order to avoid startup costs associated with re-parsing the memory image. And a (clever?) hack for getting volshell plugin output in different forms such as JSON or CSV.… Continue reading Fun With volshell →
jq is a great tool for parsing JSON data. But DFIR professionals often apply jq differently from the typical examples you see written for developers.… Continue reading jq For Forensics →
Introducing a contest based around a new Linux forensic scenario I created. Submissions for judging are due by 2026-04-15 23:59 UTC!… Continue reading Linux Forensic Scenario →
Confused about timestamp options and output with the Linux ls command? Here are some of my favorite tips!… Continue reading Linux Notes: ls and Timestamps →
In my previous blog post I demonstrated a method for persisting a Linux LKM rootkit across reboots by leveraging systemd-modules-load. For this method to work, we needed to add the evil module into the /usr/lib/modules/$(uname -r) directory and then run depmod. As I pointed out in the article, while the LKM could hide the module… Continue reading A Little More on LKM Persistence →