02 · Logs & Journal
Linux Log Forensics: syslog, journald, wtmp and auditd
How to analyse Linux logs in an investigation: rsyslog files, sshd and sudo lines, the journald binary journal, wtmp/btmp, auditd and tampering signs.
logsjournaldsyslog
Guides tagged: #ssh
03 · User Activity
Linux Shell History and User Activity Forensics
Reconstruct what a user did on a Linux host from bash, zsh and fish history, dotfiles, SSH files, sudo logs and account databases, and spot history evasion.
shell-historybashuser-activity