Practical Linux Forensics: A Guide for Digital Investigators

517 Pages·2021·6.955 MB·English

by  Bruce Nikkel

PRACTICAL LINUX FORENSICS
A Guide for Digital Investigators
by Bruce Nikkel
San Francisco
PRACTICAL LINUX FORENSICS. Copyright © 2022 by Bruce Nikkel
All rights reserved. No part of this work may be reproduced or transmitted in any form or by
any means, electronic or mechanical, including photocopying, recording, or by any information
storage or retrieval system, without the prior written permission of the copyright owner and the
publisher.
Printed in the United States of America
First printing
25 24 23 22 21         1 2 3 4 5 6 7 8 9
ISBN-13: 978-1-7185-0196-6 (print)
ISBN-13: 978-1-7185-0197-3 (ebook)
Publisher: William Pollock
Managing Editor: Jill Franklin
Production Manager: Rachel Monaghan
Production Editor: Miles Bond
Developmental Editor: Jill Franklin
Interior and Cover Design: Octopod Studios
Cover Illustrator: James L. Barry
Technical Reviewer: Don Frick
Copyeditor: George Hale
Production Services: Octal Publishing, Inc.
For information on book distributors or translations, please contact No Starch Press, Inc.
directly:
No Starch Press, Inc.
245 8th Street, San Francisco, CA 94103
phone: [phone]; [email protected]
www.nostarch.com
Library of Congress Cataloging-in-Publication Data
Names: Nikkel, Bruce, author.
Title: Practical Linux forensics : a guide for digital investigators / by
   Bruce Nikkel.
Description: San Francisco : no starch press, [2022] | Includes index. |
Identifiers: LCCN 2021031364 (print) | LCCN 2021031365 (ebook) | ISBN
   9781718501966 (paperback) | ISBN 9781718501973 (ebook)
Subjects: LCSH: Digital forensic science. | Linux. | Computer
   crimes–Investigation. | Data recovery (Computer science)
Classification: LCC HV8079.C65 N56 2022 (print) | LCC HV8079.C65 (ebook)
   | DDC 363.25/968–dc23
LC record available at https://lccn.loc.gov/2021031364
LC ebook record available at https://lccn.loc.gov/2021031365
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press,
Inc. Other product and company names mentioned herein may be the trademarks of their
respective owners. Rather than use a trademark symbol with every occurrence of a trademarked
name, we are using the names only in an editorial fashion and to the benefit of the trademark
owner, with no intention of infringement of the trademark.
The information in this book is distributed on an “As Is” basis, without warranty. While every
precaution has been taken in the preparation of this work, neither the author nor No Starch
Press, Inc. shall have any liability to any person or entity with respect to any loss or damage
caused or alleged to be caused directly or indirectly by the information contained in it.
[S]
This book is dedicated to everyone who provided motivation, support,
guidance, mentoring, inspiration, encouragement, critiques, wisdom,
tools, techniques, and research—all of which influenced and helped
with the creation of this book.
About the Author
Bruce Nikkel is a professor at the Bern University of Applied Sciences
in Switzerland, specializing in digital forensics and cybercrime. He is
co-head of the university’s research institute for cybersecurity and
engineering, and director of the masters program in Digital Forensics
and Cyber Investigation. In addition to his academic work, he has
worked in risk and security departments at a global financial institution
since 1997. He headed the bank’s Cybercrime Intelligence & Forensic
Investigation team for more than 15 years and currently works as an
advisor. Bruce holds a PhD in network forensics, is the author of
Practical Forensic Imaging (No Starch Press, 2016), and is an editor with
Forensic Science International’s Digital Investigation journal. He has
been a Unix and Linux enthusiast since the 1990s.
About the Technical Reviewer
Don Frick started his career as an IT forensics consultant for a Big Four
firm, collecting evidence and conducting investigations for clients across
Europe, and eventually came to lead the Forensic Technology team
based in Zurich. He later moved to New York to open a forensic lab for
a major global financial institution. As part of the bank’s Cybercrime
Intelligence & Forensic Investigation team, he has worked on a wide
range of investigations. He enjoys tinkering with hardware and different
operating systems (Linux, macOS, Windows) in his free time.
BRIEF CONTENTS
Introduction
Chapter 1: Digital Forensics Overview
Chapter 2: Linux Overview
Chapter 3: Evidence from Storage Devices and Filesystems
Chapter 4: Directory Layout and Forensic Analysis of Linux Files
Chapter 5: Investigating Evidence from Linux Logs
Chapter 6: Reconstructing System Boot and Initialization
Chapter 7: Examination of Installed Software Packages
Chapter 8: Identifying Network Configuration Artifacts
Chapter 9: Forensic Analysis of Time and Location
Chapter 10: Reconstructing User Desktops and Login Activity
Chapter 11: Forensic Traces of Attached Peripheral Devices
Afterword
Appendix: File/Directory List for Digital Investigators
Index
CONTENTS IN DETAIL
INTRODUCTION
Why I Wrote This Book
How This Book Is Unique
Linux Forensic Analysis Scenarios
Target Audience and Prerequisites
Who Should Read This Book?
Prerequisite Knowledge
Forensic Tools and Platforms Needed
Scope and Organization
Content Scope
Book Organization and Structure
Overview of Chapters
Conventions and Format
Formatting and Presentation
Data Flow Diagrams
1
DIGITAL FORENSICS OVERVIEW
Digital Forensics History
Pre-Y2K
2000–2010
2010–2020
2020 and Beyond
Forensic Analysis Trends and Challenges
Shift in Size, Location, and Complexity of Evidence
Multi-Jurisdictional Aspects
Industry, Academia, and Law Enforcement Collaboration
Principles of Postmortem Computer Forensic Analysis
Digital Forensic Standards