In-depth Linux forensics and incident response guides, from evidence acquisition to super-timelines.
How to acquire Linux evidence soundly: order of volatility, live vs dead acquisition, dd/dc3dd/ewfacquire imaging, cloud snapshots and read-only mounts.
Investigate Docker, containerd and Podman hosts: container metadata, overlay2 upper layers, JSON logs, escape indicators and Kubernetes node log paths.
How to read MAC and birth timestamps on ext4 and XFS, spot timestomping through ctime, and understand the real limits of deleted file recovery on Linux.
Where attackers hide persistence on Linux (cron, systemd units and timers, shell startup files, SSH keys, ld.so.preload, PAM, udev, modules) and how to find it.
How to analyse Linux logs in an investigation: rsyslog files, sshd and sudo lines, the journald binary journal, wtmp/btmp, auditd and tampering signs.
Acquire Linux RAM with LiME or AVML, build Volatility 3 symbol tables with dwarf2json, and find hidden processes, rootkit modules and bash history in memory.
Build a Linux forensic super timeline with TSK mactime and Plaso: log2timeline, psort and pinfo, Linux parsers, time slicing, UTC and Timesketch.
A practical Linux live response workflow: trusted binaries, logging your actions, and triaging processes, sockets and modules through /proc before shutdown.
Use dpkg, APT, RPM and DNF logs and databases to date installs, verify file integrity and find binaries no package owns on a compromised Linux host.