SysAdmin: Linux Memory Forensics

“Forensic analysis is the investigation of an event that
involves looking for evidence and interpreting that evidence. In
the case of a computer crime in which a system was compromised, the
investigator needs to find out who, what, where, when, how, and
why.

“There are three main areas from which evidence of an intrusion
can be gathered. The first and most common is the hard drive. A
file system on a hard drive contains the least volatile data.
Whether the investigator’s strategy involves shutting down the
system or just removing the computer’s power, the file system will
still be there. The investigator’s response strategy will dictate
what changes are made to the file system. If the file system is
shut down or if the investigator issues commands to the system to
collect information, the file system may be changed, but in the
end, it’s still there. There are then many tools, such as The
Sleuth Kit or The Coroner’s Toolkit (TCT), that can be used to
analyze the file system.

“The second, and most volatile, of the three areas is network
traffic. Once a packet has reached its destination, it’s no longer
on the wire, and it will only exist briefly in memory on the
received system. Regional and national laws dictate the legality of
collecting network traffic, but many tools exist to do so. These
include intrusion detection systems (IDS), such as Snort, and
network monitoring facilities, such as tcpdump or Ethereal…”

Complete
Story