LinuxFest Northwest 2018: Linux File System Forensics
Channel: linuxfestnorthwest
Date: 2018-04-30

Gary Smith 

Frequently, performing a forensic analysis of a Linux disk image is often part of incident response to determine if a breach has occurred. Linux forensics is quite a different and fascinating world compared with Microsoft Windows forensics. In this presentation, we will analyze a disk image from a potentially compromised Linux system. We will attempt to determine the who, what, when, where, why, and how, create an event time line and a file system time line. Finally, we will extract artifacts of interest from the disk image. This presentation includes a demo so any sacrifices to appease the demo gods would be appreciated.