What are the options for acquiring disk image from a Linux computer that can't be removed from a crime scene?
If the suspect's computer is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk image? Or do you need to use forensic live cds like Helix, Penguin sleuth or ...
I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of ...
I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...