Quote:A non-exhaustive list of topics to be covered includes:
Live response
First talk to the humans
What do they think happened
Details on victim system(s)
Mount response kit with known good tools
cdrom preferred as it was not likely part of compromise
USB MS can be used if no CDROM
Using netcat to minimize contamination
Collecting volatile data
date and time
network interfaces
funny networks
promiscuous mode?
network connections
open ports
programs associated with ports
running processes
open files
routing tables
mounted filesystems
loaded kernel modules
Collecting data to determine if dead analysis is justified
kernel version
uptime
filesystem datetime stamps
hash values for system files
current user logins
login history
system logs
user accounts
user history files
hidden files and directories
sending off suspicious files for further study
Dumping RAM
Making the decision to dump RAM
Using fmem
Using LiME
Using /proc/kcore
Acquiring filesystem images
Using dd
Using dcfldd
Write blocking options
Forensic Linux distros
Udev rules based blocker
Analyzing filesystem images
Mounting images
Files with basic system info
Files with suspicious user info
Examining logs
Process-related files
Authentication-related files
Using standard Linux tools to find information
Strange files
Regular files in /dev
User history files
Hidden files
SUID/SGID files
Detecting backdated files
Recovering deleted files
Finding deleted files
Attempting recovery
Leveraging The Sleuth Kit (TSK) and Autopsy
mmls
fsstat
dstat
istat
fls & mactime
Timeline Analysis
When was system installed, upgraded, booted, etc.
Newly created files (malware)
Changed files (trojans)
Files in the wrong place (exfiltration)
Digging deeper into Linux filesystems
Disk editors
Active@ Disk Editor
Autopsy
ExtX
Basics
Superblocks
Directory entries
Inodes
Data blocks
Compatible, incompatible, and read-only compatible features
Experimental features may be installed
Boot code