Area 08
Package managers keep an audit trail of what was installed and what each file should look like; container runtimes keep layered filesystems and logs of their own. This area covers dpkg and rpm verification, install histories, and container evidence on the host.
Key artifacts
Use dpkg, APT, RPM and DNF logs and databases to date installs, verify file integrity and find binaries no package owns on a compromised Linux host.
Investigate Docker, containerd and Podman hosts: container metadata, overlay2 upper layers, JSON logs, escape indicators and Kubernetes node log paths.
Where each artifact lives, what it proves, its timestamps and the tools to parse it.