Basic Forensic Analysis in Linux: Collect and Examine Evidence

In the realm of digital investigations, Linux provides a versatile and powerful environment for collecting and examining evidence. Whether responding to a security breach, conducting an internal audit, or gathering evidence for legal proceedings, a structured approach ensures integrity, repeatability, and credibility.

Table of Contents

• Overview and Principles
• Planning and Preparation
• Evidence Collection
• Disk and File System Analysis
• Memory Forensics
• Log and Timeline Creation
• Network Traffic Analysis
• Reporting and Documentation
• Recommended Tools and VPNs

1. Overview and Principles

Effective forensic analysis in Linux adheres to several core principles:

• Integrity: Maintain the original evidence in an unaltered state. Work only on cryptographic copies.
• Chain of Custody: Document every action taken—who, when, what tools, and why.
• Repeatability: Steps must be reproducible by another examiner using the same data and methods.
• Legality: Ensure all actions are lawful and properly authorized.

2. Planning and Preparation

2.1 Define Scope and Objectives

• Identify systems, timeframes, and data types of interest.
• Obtain necessary legal authorization (warrants, managerial approval).

2.2 Prepare a Forensic Workstation

• Use a dedicated, read-only environment.
• Install relevant tools (The Sleuth Kit, Autopsy, Volatility, Autopsy).
• Verify tool versions and checksums.

3. Evidence Collection

3.1 Disk Imaging

Disk imaging creates a bit-by-bit copy of storage media.

1. Identify device with lsblk or fdisk -l.
2. Compute a cryptographic hash (sha256sum):
   sha256sum /dev/sdb gt sdb.sha256
3. Use dd or dcfldd for imaging:
   dd if=/dev/sdb bs=4M conv=sync,noerror tee image.dd sha256sum gt image.sha256

3.2 Collecting System Metadata

• uname -a for kernel/version
• ps aux, netstat -tulpen, mount
• Network configuration: ip addr show, iptables -L -v

3.3 Memory Acquisition

Capturing RAM can reveal running processes, network connections, and decrypted data.

• Use avml or lime modules:
• ./avml --output memory.lime
• Hash memory image: sha256sum memory.lime gt memory.sha256

4. Disk and File System Analysis

4.1 The Sleuth Kit (TSK)

• fls to list deleted and existing files.
• icat to carve out specific file inodes.
• mactime to generate timeline CSV.

4.2 File System Carving

• bulk_extractor to extract emails, URLs, credit card numbers.
• PhotoRec for multimedia recovery.

4.3 File Metadata and Hashing

List file metadata and verify integrity:

find /mnt/image -type f -exec sha256sum {} gt files.sha256

5. Memory Forensics

5.1 Volatility Framework

• Install via Python pip: pip install volatility3.
• Identify profile: vol --info grep Linux.
• Extract processes:
  vol -f memory.lime linux_pslist
• Dump open files: vol -f memory.lime linux_lsof

5.2 Detecting Malicious Code

• Scan memory for injected DLLs or suspicious network sockets.
• Use strings and grep for known Indicators of Compromise (IOCs).

6. Log and Timeline Creation

6.1 System Log Gathering

• /var/log/syslog, auth.log, secure
• Web server logs (/var/log/apache2/ access.log)

6.2 log2timeline (Plaso)

1. Install: pip install plaso
2. Create storage: log2timeline.py plaso.dump image.dd
3. Review: pinfo.py plaso.dump

6.3 Timeline Analysis

Import CSV into a spreadsheet or timeline tool. Look for anomalies in sequence:

• Unexpected logins at odd hours
• Mass file deletions/creations

7. Network Traffic Analysis

7.1 Packet Capture

• Use tcpdump: tcpdump -i eth0 -w capture.pcap
• Hash the PCAP: sha256sum capture.pcap

7.2 Analysis with Wireshark and tshark

• Open in Wireshark for deep inspection.
• Use tshark -r capture.pcap -q -z conv,ip for conversations.
• Filter suspicious traffic: ip.dst==10.0.0.5 and tcp.port==22

8. Reporting and Documentation

A credible forensic report includes:

• Executive Summary
• Scope, Objectives, and Methodology
• Tools and Versions
• Evidence Collected (with hashes, timestamps)
• Findings and Analysis
• Conclusions and Recommendations
• Appendices (detailed logs, command outputs)

9. Recommended Tools and VPNs

Secure Remote Work with VPN

During investigations, secure communications are essential. Recommended VPN services include:

• NordVPN – Double encryption, large server network.
• ExpressVPN – High speeds, RAM-only servers.
• ProtonVPN – Privacy-focused, no-logs policy.