Linux-Forensik: Parser und Tools

Alle auf dieser Website genannten Parser und Tools, mit Lizenz und den Artefakten, die sie verarbeiten. Öffnen Sie ein Artefakt, um zu sehen, wie man sie einsetzt.

90 Tools

Tool	Typ	Artefakte
Browser Forensics	Browser	Browser Profiles on Linux
Disk Image Parser	Browser	ext4-Zeitstempel, crtime und gelöschte Dateien XFS Forensics
Hash Extractor	Browser	SSH-Artefakte
Linux Log Parser	Browser	auditd audit.log auth.log, secure und syslog Linux Firewall Logs SSH-Artefakte sudo-Logs systemd-Journal wtmp, btmp, utmp und lastlog
PCAP Parser	Browser	Linux Firewall Logs
RAM Parser	Browser	Linux Kernel Modules Linux Memory Acquisition Shell-History
grep / zgrepGNU grep, gzip	CLI · in Linux enthalten	/etc/hosts, nsswitch.conf and resolv.conf on Linux Apache and Nginx Logs AppArmor and SELinux Denials auth.log, secure und syslog cloud-init Logs and Instance Data Cron, Anacron, at und systemd-Timer dmesg, kern.log and the Kernel Ring Buffer on Linux dpkg, APT, RPM and DNF Logs Linux Firewall Logs logrotate State and Log Gaps MySQL, MariaDB and PostgreSQL Logs NetworkManager Profiles and State PAM Configuration and Modules rc.local, SysV init.d and MOTD Scripts SSH-Artefakte sudo-Logs sysctl, Boot Parameters and binfmt_misc on Linux udev and USB Device History on Linux Web Shells in the Web Root XDG Autostart .desktop Entries
Plaso	CLI · Open Source	Apache and Nginx Logs auditd audit.log auth.log, secure und syslog Browser Profiles on Linux dpkg, APT, RPM and DNF Logs ext4-Zeitstempel, crtime und gelöschte Dateien Linux Firewall Logs NetworkManager Profiles and State Shell-History sudo-Logs systemd-Journal udev and USB Device History on Linux viminfo, ShaDa and lesshst wtmp, btmp, utmp und lastlog XFS Forensics
journalctlsystemd	CLI · in Linux enthalten	/etc/hosts, nsswitch.conf and resolv.conf on Linux AppArmor and SELinux Denials cloud-init Logs and Instance Data dmesg, kern.log and the Kernel Ring Buffer on Linux Linux Firewall Logs logrotate State and Log Gaps MySQL, MariaDB and PostgreSQL Logs NetworkManager Profiles and State rc.local, SysV init.d and MOTD Scripts Snap and Flatpak Artifacts sudo-Logs systemd-Journal udev and USB Device History on Linux XDG Autostart .desktop Entries
Velociraptor	Plattform · Open Source	/etc/ld.so.preload und LD_PRELOAD /etc/passwd, shadow and group /proc-Live-Artefakte /tmp, /var/tmp and /dev/shm Cron, Anacron, at und systemd-Timer Linux Kernel Modules rc.local, SysV init.d and MOTD Scripts Shell Startup Files Shell-History SSH-Artefakte systemd-Journal systemd-Unit-Dateien wtmp, btmp, utmp und lastlog
findGNU findutils	CLI · in Linux enthalten	/tmp, /var/tmp and /dev/shm eBPF Programs and Pinned Maps Linux Thumbnail Cache Linux Trash logrotate State and Log Gaps PAM Configuration and Modules Snap and Flatpak Artifacts SUID, SGID and File Capabilities sysctl, Boot Parameters and binfmt_misc on Linux Web Shells in the Web Root XDG Autostart .desktop Entries
rpmRPM	CLI · in Linux enthalten	/etc/hosts, nsswitch.conf and resolv.conf on Linux dpkg, APT, RPM and DNF Logs PAM Configuration and Modules Shell Startup Files SUID, SGID and File Capabilities sysctl, Boot Parameters and binfmt_misc on Linux Web Shells in the Web Root XDG Autostart .desktop Entries
statGNU coreutils	CLI · in Linux enthalten	/tmp, /var/tmp and /dev/shm ext4-Zeitstempel, crtime und gelöschte Dateien Linux Thumbnail Cache Linux Trash logrotate State and Log Gaps SUID, SGID and File Capabilities Web Shells in the Web Root XFS Forensics
dpkgDebian	CLI · in Linux enthalten	/etc/hosts, nsswitch.conf and resolv.conf on Linux dpkg, APT, RPM and DNF Logs PAM Configuration and Modules SUID, SGID and File Capabilities sysctl, Boot Parameters and binfmt_misc on Linux Web Shells in the Web Root XDG Autostart .desktop Entries
UAC	CLI · Open Source	/etc/ld.so.preload und LD_PRELOAD Cron, Anacron, at und systemd-Timer Linux Kernel Modules rc.local, SysV init.d and MOTD Scripts SSH-Artefakte systemd-Unit-Dateien
Volatility 3	CLI · Open Source	/etc/ld.so.preload und LD_PRELOAD /proc-Live-Artefakte eBPF Programs and Pinned Maps Linux Kernel Modules Linux Memory Acquisition Shell-History
ausearchLinux Audit	CLI · in Linux enthalten	/etc/passwd, shadow and group AppArmor and SELinux Denials auditd audit.log eBPF Programs and Pinned Maps sudo-Logs
systemctlsystemd	CLI · in Linux enthalten	Cron, Anacron, at und systemd-Timer logrotate State and Log Gaps systemd-Unit-Dateien XDG Autostart .desktop Entries
debsumsDebian	CLI · Open Source	PAM Configuration and Modules Shell Startup Files SUID, SGID and File Capabilities
debugfse2fsprogs	CLI · in Linux enthalten	/etc/ld.so.preload und LD_PRELOAD /tmp, /var/tmp and /dev/shm ext4-Zeitstempel, crtime und gelöschte Dateien
jq	CLI · Open Source	cloud-init Logs and Instance Data Docker, containerd and Podman Artifacts on Linux Hosts Snap and Flatpak Artifacts
sqlite3SQLite	CLI · Open Source	Browser Profiles on Linux dpkg, APT, RPM and DNF Logs Tracker / LocalSearch DB
aureportLinux Audit	CLI · in Linux enthalten	AppArmor and SELinux Denials auditd audit.log
awk	CLI · in Linux enthalten	/etc/passwd, shadow and group Apache and Nginx Logs
getfattrattr	CLI · in Linux enthalten	Linux Crash Reports and Core Dumps SUID, SGID and File Capabilities
lnav	CLI · Open Source	Apache and Nginx Logs auth.log, secure und syslog
ssiproute2	CLI · in Linux enthalten	/proc-Live-Artefakte eBPF Programs and Pinned Maps
systemd-analyzesystemd	CLI · in Linux enthalten	sysctl, Boot Parameters and binfmt_misc on Linux systemd-Unit-Dateien
The Sleuth Kit	CLI · Open Source	/tmp, /var/tmp and /dev/shm ext4-Zeitstempel, crtime und gelöschte Dateien
aa-statusAppArmor	CLI · in Linux enthalten	AppArmor and SELinux Denials
apport-unpackUbuntu	CLI · in Linux enthalten	Linux Crash Reports and Core Dumps
audit2whySELinux policycoreutils	CLI · in Linux enthalten	AppArmor and SELinux Denials
authselectRHEL / Fedora	CLI · in Linux enthalten	PAM Configuration and Modules
AVMLMicrosoft	CLI · Open Source	Linux Memory Acquisition
bpftoolLinux kernel / libbpf	CLI · Open Source	eBPF Programs and Pinned Maps
cloud-initCanonical	CLI · Open Source	cloud-init Logs and Instance Data
container-explorerGoogle	CLI · Open Source	Docker, containerd and Podman Artifacts on Linux Hosts
coredumpctlsystemd	CLI · in Linux enthalten	Linux Crash Reports and Core Dumps
crash	CLI · Open Source	Linux Crash Reports and Core Dumps
crictlKubernetes	CLI · Open Source	Docker, containerd and Podman Artifacts on Linux Hosts
ctrcontainerd	CLI · Open Source	Docker, containerd and Podman Artifacts on Linux Hosts
dmesgutil-linux	CLI · in Linux enthalten	dmesg, kern.log and the Kernel Ring Buffer on Linux
dockerDocker	CLI · Open Source	Docker, containerd and Podman Artifacts on Linux Hosts
dwarf2json	CLI · Open Source	Linux Memory Acquisition
ExifTool	CLI · Open Source	Linux Thumbnail Cache
ext4magic	CLI · Open Source	ext4-Zeitstempel, crtime und gelöschte Dateien
flatpakFlatpak	CLI · in Linux enthalten	Snap and Flatpak Artifacts
gdbGNU	CLI · Open Source	Linux Crash Reports and Core Dumps
getcaplibcap	CLI · in Linux enthalten	SUID, SGID and File Capabilities
getentglibc	CLI · in Linux enthalten	/etc/hosts, nsswitch.conf and resolv.conf on Linux
gioGLib	CLI · in Linux enthalten	Linux Trash
GoAccess	CLI · Open Source	Apache and Nginx Logs
Hindsight	CLI · Open Source	Browser Profiles on Linux
iptables-saveiptables	CLI · in Linux enthalten	Linux Firewall Logs
last / lastbutil-linux	CLI · in Linux enthalten	wtmp, btmp, utmp und lastlog
libfsxfslibyal	Bibliothek · Open Source	XFS Forensics
LiME	CLI · Open Source	Linux Memory Acquisition
localsearchGNOME	CLI · Open Source	Tracker / LocalSearch DB
logrotate	CLI · in Linux enthalten	logrotate State and Log Gaps
lsof	CLI · in Linux enthalten	/proc-Live-Artefakte
modinfokmod	CLI · in Linux enthalten	Linux Kernel Modules
mysqlbinlogOracle MySQL	CLI · Open Source	MySQL, MariaDB and PostgreSQL Logs
Neovim	CLI · Open Source	viminfo, ShaDa and lesshst
nftnftables	CLI · in Linux enthalten	Linux Firewall Logs
nmcliNetworkManager	CLI · in Linux enthalten	NetworkManager Profiles and State
pgBadger	CLI · Open Source	MySQL, MariaDB and PostgreSQL Logs
php-malware-finder	CLI · Open Source	Web Shells in the Web Root
psprocps	CLI · in Linux enthalten	/proc-Live-Artefakte
pwck / grpckshadow-utils	CLI · in Linux enthalten	/etc/passwd, shadow and group
Python ElementTreePython standard library	Bibliothek · Open Source	recently-used.xbel
python-msgpack	Bibliothek · Open Source	viminfo, ShaDa and lesshst
readelfGNU binutils	CLI · in Linux enthalten	eBPF Programs and Pinned Maps
resolvectlsystemd	CLI · in Linux enthalten	/etc/hosts, nsswitch.conf and resolv.conf on Linux
sealertsetroubleshoot	CLI · in Linux enthalten	AppArmor and SELinux Denials
semoduleSELinux policycoreutils	CLI · in Linux enthalten	AppArmor and SELinux Denials
sestatusSELinux policycoreutils	CLI · in Linux enthalten	AppArmor and SELinux Denials
snapCanonical snapd	CLI · in Linux enthalten	Snap and Flatpak Artifacts
ssh-keygenOpenSSH	CLI · in Linux enthalten	SSH-Artefakte
stringsGNU binutils	CLI · in Linux enthalten	PAM Configuration and Modules
sudoreplaysudo	CLI · in Linux enthalten	sudo-Logs
sysctlprocps	CLI · in Linux enthalten	sysctl, Boot Parameters and binfmt_misc on Linux
tinysparqlGNOME	CLI · Open Source	Tracker / LocalSearch DB
trash-cli	CLI · Open Source	Linux Trash
udevadmsystemd	CLI · in Linux enthalten	udev and USB Device History on Linux
utmpdumputil-linux	CLI · in Linux enthalten	wtmp, btmp, utmp und lastlog
wtmpdb	CLI · Open Source	wtmp, btmp, utmp und lastlog
xfs_dbxfsprogs	CLI · in Linux enthalten	XFS Forensics
xmllintlibxml2	CLI · Open Source	recently-used.xbel
YARAVirusTotal	CLI · Open Source	Web Shells in the Web Root
Zircolite	CLI · Open Source	auditd audit.log