LinuxFest Northwest 2018: Incident Response With Live Linux Forensics
Channel: linuxfestnorthwest
Date: 2018-05-01

Gary Smith

A major part of incident response is answering the question, "Do we have an incident?" To answer that question you can use live Linux forensics. In this presentation, we will look at the some of the steps in incident response, specifically, the preparation phase. Next we'll look at what forms of information we can gather from a live Linux system and its forensic value. Finally, we'll look at scripts to automate the process of gathering forensic evidence. If the demo gods are smiling on us, there will be a demo of gathering forensic information from a system suspected of having an incident and answering the question, "Do we have an incident?"