Linux Forensics — Blog https://www.linuxforensics.app/en/blog Latest from Blog en Wed, 30 Sep 2026 00:53:55 GMT Acquiring Linux Evidence: Disk Imaging and Read-Only Mounts https://www.linuxforensics.app/en/blog/acquiring-linux-evidence https://www.linuxforensics.app/en/blog/acquiring-linux-evidence How to acquire Linux evidence soundly: order of volatility, live vs dead acquisition, dd/dc3dd/ewfacquire imaging, cloud snapshots and read-only mounts. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Container Forensics: Docker, containerd and Podman on Linux https://www.linuxforensics.app/en/blog/container-forensics-docker-containerd https://www.linuxforensics.app/en/blog/container-forensics-docker-containerd Investigate Docker, containerd and Podman hosts: container metadata, overlay2 upper layers, JSON logs, escape indicators and Kubernetes node log paths. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT ext4 and XFS Timestamps, Inodes and Deleted Files https://www.linuxforensics.app/en/blog/ext4-xfs-timestamps-and-deleted-files https://www.linuxforensics.app/en/blog/ext4-xfs-timestamps-and-deleted-files How to read MAC and birth timestamps on ext4 and XFS, spot timestomping through ctime, and understand the real limits of deleted file recovery on Linux. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Hunting Linux Persistence: Cron, systemd, SSH and More https://www.linuxforensics.app/en/blog/hunting-linux-persistence https://www.linuxforensics.app/en/blog/hunting-linux-persistence Where attackers hide persistence on Linux (cron, systemd units and timers, shell startup files, SSH keys, ld.so.preload, PAM, udev, modules) and how to find it. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Linux Log Forensics: syslog, journald, wtmp and auditd https://www.linuxforensics.app/en/blog/linux-log-forensics-syslog-journald https://www.linuxforensics.app/en/blog/linux-log-forensics-syslog-journald How to analyse Linux logs in an investigation: rsyslog files, sshd and sudo lines, the journald binary journal, wtmp/btmp, auditd and tampering signs. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Linux Memory Forensics with LiME, AVML and Volatility 3 https://www.linuxforensics.app/en/blog/linux-memory-forensics-lime-volatility https://www.linuxforensics.app/en/blog/linux-memory-forensics-lime-volatility Acquire Linux RAM with LiME or AVML, build Volatility 3 symbol tables with dwarf2json, and find hidden processes, rootkit modules and bash history in memory. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Building a Linux Super Timeline with Plaso and mactime https://www.linuxforensics.app/en/blog/linux-super-timeline-plaso https://www.linuxforensics.app/en/blog/linux-super-timeline-plaso Build a Linux forensic super timeline with TSK mactime and Plaso: log2timeline, psort and pinfo, Linux parsers, time slicing, UTC and Timesketch. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Linux Live Response: Triage Through /proc and Volatile Data https://www.linuxforensics.app/en/blog/live-response-proc-triage https://www.linuxforensics.app/en/blog/live-response-proc-triage A practical Linux live response workflow: trusted binaries, logging your actions, and triaging processes, sockets and modules through /proc before shutdown. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Package Manager Forensics on Linux: dpkg, APT, RPM and DNF https://www.linuxforensics.app/en/blog/package-manager-forensics-dpkg-rpm https://www.linuxforensics.app/en/blog/package-manager-forensics-dpkg-rpm Use dpkg, APT, RPM and DNF logs and databases to date installs, verify file integrity and find binaries no package owns on a compromised Linux host. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Linux Shell History and User Activity Forensics https://www.linuxforensics.app/en/blog/shell-history-and-user-activity https://www.linuxforensics.app/en/blog/shell-history-and-user-activity Reconstruct what a user did on a Linux host from bash, zsh and fish history, dotfiles, SSH files, sudo logs and account databases, and spot history evasion. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT Linux Triage Collection with UAC and Velociraptor https://www.linuxforensics.app/en/blog/triage-collection-uac-velociraptor https://www.linuxforensics.app/en/blog/triage-collection-uac-velociraptor Run fast, repeatable Linux triage with UAC profiles and Velociraptor Linux artifacts: what each collects, offline collectors, hunts and what to grab first. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT