# investigation part (blogs) — RSS Amplifier Recent posts from the 2 feeds in the RSS Amplifier directory that cover investigation part. Page: Feed: --- ## [Workaround For Duplicate LVM Names](https://righteousit.com/2026/08/03/workaround-for-duplicate-lvm-names/) _2026-08-03 · Hal Pomeranz · Righteous IT_ Forensic images of Linux systems derived from a common "master" image can cause problems for investigators. Linux refuses to mount an image if the LVM UUIDs in the image are the same as an already mounted image. We can use a write cache created by the xmount program to change these UUIDs without impacting the original image files.… Continue reading Workaround For Duplicate LVM Names → ## [Linux Investigation (Part 4)](https://righteousit.com/2026/05/07/linux-investigation-part-4/) _2026-05-07 · Hal Pomeranz · Righteous IT_ What did I actually do to create our Linux forensic scenario. This installment is the attacker's view of the process.… Continue reading Linux Investigation (Part 4) → ## [Linux Investigation (Part 3)](https://righteousit.com/2026/05/06/linux-investigation-part-3/) _2026-05-06 · Hal Pomeranz · Righteous IT_ Wrapping up our Linux investigation. Memory and timeline analysis to answer some lingering questions.… Continue reading Linux Investigation (Part 3) → ## [Linux Investigation (Part 2)](https://righteousit.com/2026/05/05/linux-investigation-part-2/) _2026-05-05 · Hal Pomeranz · Righteous IT_ Digging into our Linux investigation with memory analysis. Suspicious process details revealed!… Continue reading Linux Investigation (Part 2) → ## [Linux Investigation (Part 1)](https://righteousit.com/2026/05/04/linux-investigation-part-1/) _2026-05-04 · Hal Pomeranz · Righteous IT_ Analyzing a Linux DFIR scenario. In Part 1 we find a possible rootkit and tie its appearance to a recent SSH session seen in the system logs.… Continue reading Linux Investigation (Part 1) → ## [Fun With volshell](https://righteousit.com/2026/04/22/fun-with-volshell/) _2026-04-22 · Hal Pomeranz · Righteous IT_ An intro to running multiple Volatility plugins via volshell in order to avoid startup costs associated with re-parsing the memory image. And a (clever?) hack for getting volshell plugin output in different forms such as JSON or CSV.… Continue reading Fun With volshell → ## [Fun With volshell](https://righteousit.com/2026/04/22/fun-with-volshell/) _2026-04-22 · Hal Pomeranz · Righteous IT_ An intro to running multiple Volatility plugins via volshell in order to avoid startup costs associated with re-parsing the memory image. And a (clever?) hack for getting volshell plugin output in different forms such as JSON or CSV.… Continue reading Fun With volshell → ## [jq For Forensics](https://righteousit.com/2026/04/06/jq-for-forensics/) _2026-04-06 · Hal Pomeranz · Righteous IT_ jq is a great tool for parsing JSON data. But DFIR professionals often apply jq differently from the typical examples you see written for developers.… Continue reading jq For Forensics → ## [jq For Forensics](https://righteousit.com/2026/04/06/jq-for-forensics/) _2026-04-06 · Hal Pomeranz · Righteous IT_ jq is a great tool for parsing JSON data. But DFIR professionals often apply jq differently from the typical examples you see written for developers.… Continue reading jq For Forensics → ## [Linux Forensic Scenario](https://righteousit.com/2026/03/27/linux-forensic-scenario/) _2026-03-27 · Hal Pomeranz · Righteous IT_ Introducing a contest based around a new Linux forensic scenario I created. Submissions for judging are due by 2026-04-15 23:59 UTC!… Continue reading Linux Forensic Scenario → ## [Real SIMs for AI Agents (Sponsored)](https://crawlproof.com/a/6RNMo9XPkiMH) _2026-03-27 · **Sponsored**_ Pass 2FA and verifications with real carrier numbers via our API. ## [Linux Forensic Scenario](https://righteousit.com/2026/03/27/linux-forensic-scenario/) _2026-03-27 · Hal Pomeranz · Righteous IT_ Introducing a contest based around a new Linux forensic scenario I created. Submissions for judging are due by 2026-04-15 23:59 UTC!… Continue reading Linux Forensic Scenario → ## [Linux Notes: ls and Timestamps](https://righteousit.com/2026/03/06/linux-notes-ls-and-timestamps/) _2026-03-06 · Hal Pomeranz · Righteous IT_ Confused about timestamp options and output with the Linux ls command? Here are some of my favorite tips!… Continue reading Linux Notes: ls and Timestamps → ## [A Little More on LKM Persistence](https://righteousit.com/2024/12/21/a-little-more-on-lkm-persistence/) _2024-12-21 · Hal Pomeranz · Righteous IT_ In my previous blog post I demonstrated a method for persisting a Linux LKM rootkit across reboots by leveraging systemd-modules-load. For this method to work, we needed to add the evil module into the /usr/lib/modules/$(uname -r) directory and then run depmod. As I pointed out in the article, while the LKM could hide the module… Continue reading A Little More on LKM Persistence →