Linux Forensics Tools
Two of the most commonly used Linux forensics tools are Autopsy and the Sleuth Kit. These programs are intuitive and are a compilation of the following:
• File system layer tools
• File system journal tools
• Meta data layer tools
• Disk image file tools
Despite the fact that Autopsy and the Sleuth Kit run on Linux, they support the NTFS, FAT, Ext2/3, and UFS1/2 file systems. You can download Autopsy and the Sleuth Kit free from http://www.sleuthkit.org.
Figure 5-2 is a screen shot of Autopsy.
Figure 5-2 Autopsy Linux Forensics Tool
Figure 5-2 Autopsy Linux Forensics Tool
Figure 5-2 shows how you can use Autopsy to analyze the files and directories within a system. You can use this tool to see the names of deleted files. Autopsy can create timelines that contain entries for the "Modified, Access, and Change" times of both allocated and unallocated files. It also allows you to create a "case" to track each security incident.
When collecting information from a Linux or UNIX-based system, you can also use simple tools and commands such as netstat and pstree. You can use the netstat -tap command as shown in Figure 5-3 to obtain information about the active connections in a system.
Figure 5-3 netstat Command Output m
File Edit View Terminal Tabs Help [root@omar netstat -tap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp tcp
[root&omar
32769 5801 mysql 5901
Foreign Address ftp
O localhost.localdomain O localhost.localdomain O localhost.localdomain O omar.cisco.com 0 omar.cisco.com 0 omar.cisco.com 0 omar.cisco.com 0 omar.cisco.com 0 omar.cisco.com 0 omar.cisco.com 0 omar.cisco.com 0 omar.cisco.com 0 omar.cisco.com 0 *:http 0 * : 6001 0 * :ssh 0 *:https
0 omar.cisco.com:ssh
5335
smtp
5335
smtp
|
mysql |
omar |
cis |
o |
com |
40718 |
|
mysql |
omar |
cis |
o |
com |
40719 |
|
mysql |
omar |
cis |
o |
com |
40720 |
|
42165 |
omar |
cis |
o |
com |
mysql |
|
40720 |
omar |
cis |
o |
com |
mysql |
|
40719 |
omar |
cis |
o |
com |
mysql |
|
40718 |
omar |
cis |
o |
com |
mysql |
|
ftp |
rtp-osan |
0£ |
-vpn5.cisco |
||
|
mysql |
omar |
cis |
o |
com |
42165 |
|
5901 |
rtp-osan |
OS |
-vpn5.cisco |
||
rtp-osantos-vpn5.cisco lUtgJM
rtp-osantos-vpn5.cisco
State LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN LISTEN ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED :4071 ESTABLISHED ESTABLISHED :4484 ESTABLISHED LISTEN LISTEN LISTEN LISTEN : 4483 ESTABLISHED
PID/Program name
2272/rpc.statd
2069/Xvnc
2717/mysqld
2069/Xvnc
2252/portmap
2069/Xvnc
2648/vsftpd
4063/cupsd
2 549/mDNSRe sponder
2743/sendmail: acce
2717/mysqld
2717/mysqld
2717/mysqld
4114/httpd
4110/httpd
4107/httpd
4109/httpd
4220/vsftpd
2717/mysqld
2069/Xvnc
2774/httpd
2069/Xvnc
2627/sshd
2774/httpd
4246/sshd: ornar [pr
In Figure 5-3, you can see the output showing the different established connections on the system.
NOTE On UNIX- and Linux-based systems (including Mac OS X), use the man netstat command to obtain detailed documentation on the available options of the netstat command.
You can also use the pstree utility on a Linux system to display the processes on the system in the form of a tree diagram. This allows you to have a better view of the processes running on the system that may be part of malicious software. Figure 5-4 includes a screen shot of the output of the pstree -hp command. The -h option is used to show the current process and its ancestors, and the -p option is used to display the process IDs (PID).
Figure 5-4 pstree Command Output
Figure 5-4 pstree Command Output
The detailed whitepaper titled "Checking UNIX/LINUX Systems for Signs of Compromise" supplies insightful information on the forensics of Linux and UNIX systems. You can download the whitepaper from http://www.ucl.ac.uk/cert/nix_intrusion.pdf.
Continue reading here: Root Cause Analysis and Lessons Learned
Was this article helpful?