THM Room: Linux Forensics

Introduction

What?

Common forensic artifacts found in the file system of Linux Operating System.

Why?

Gathering evidence of activities.

How?

• Persistence mechanisms

• Evidence of execution

• Logs