Linux Forensic Analysis reading

Try the HoneyNet Project - there are a lot of resources & examples here with regard to Linux.

Essential reading if you want to learn from the bottom up is Barry Grundy's excellent LinuxLEO. Sounds to me like you need to start somewhere in the middle though.

I had the good fortune to attend an 'Introduction to Linux Forensics' course run by Barry. Having never never encountered Linux/Unix before, I'm now developing applications for it (albeit modest one's)…

A lot of the information is about locating and recovering files; thereafter it doesn't really matter what OS you are using for analysis because it's the same file whether viewed in Linux, Solaris, OSX or Windows. I reckon it's just a case of finding the best tool for the job (and the wallet).

Paul

I suspect you will not find it. The book you mention is the only one I am aware of.

From a bog standard provincial LE perspective in the UK we deal predominantly with Windows machines from a home setting. Out of about 500 computers a year we will see less than a handful of Linux systems. So there is little justification for putting the resources into producing the material you seek.

I would guess any work like this would be on an ad hoc basis depending upon specific case by case needs.

H

I suspect you will not find it. The book you mention is the only one I am aware of.

From a bog standard provincial LE perspective in the UK we deal predominantly with Windows machines from a home setting. Out of about 500 computers a year we will see less than a handful of Linux systems. So there is little justification for putting the resources into producing the material you seek.

I would guess any work like this would be on an ad hoc basis depending upon specific case by case needs.

H

There tends to be more in the corporate/business environment, but from a server perspective, rather than an end user device. Looking at hacked Apache/Sendmail/MySQL logs might be a better place to focus rather than Internet Artifacts.

Thank you for your responses everybody. I'll check out your suggestions.

harryparsonage, I was afraid of that response. Everything seems to be geared towards intrusions, hacking etc etc.

Greetings,

In a prior life, I spent an enormous amount of time looking at Unix, Solaris, and Linux log files. I don't have any formal documentation on the analysis of them, but if you have specific questions, perhaps I can help.

-David

Thanks David. I'll send you a PM if I have any questions )

If there is a lack of material available, would you mind asking it on the forum ? That way David's answers could build the available material.

Just a thought. -)

The Linux Cookbook, not forensic but a good resource for anyone interested in how the Linux works. It is available in print and online here http//dsl.org/cookbook/cookbook_toc.html

There are a number of white papers and links to other linus related forensic web sites available at the 'linuxleo' web site at http//www.linuxleo.com/