P R A C T I C A L LINUX FORENSICS A GUIDE FOR DIGITAL INVESTIGATORS BRUCE NIKKEL EARLY ACCESS NO STARCH PRESS EARLY ACCESS PROGRAM: FEEDBACK WELCOME! Welcome to the Early Access edition of the as yet unpublished Practical Linux Forensics by Bruce Nikkel! As a prepublication title, this book may be incom- plete and some chapters may not have been proofread. Our goal is always to make the best books possible, and we look forward to hearing your thoughts. If you have any comments or questions, email us at [email protected]. If you have specific feedback for us, please include the page number, book title, and edition date in your note, and we’ll be sure to review it. We appreciate your help and support! We’ll email you as new chapters become available. In the meantime, enjoy! PR CA T IC A L L INU X FOR E N SI C S BRUCE N IK KE L Early Access edition, 6/18/21 Copyright © 2021 by Bruce Nikkel. ISBN-13: 978-1-7185-0196-6 (print) ISBN-13: 978-1-7185-0197-3 (ebook) Publisher: William Pollock Production Manager: Rachel Monaghan Production Editor: Miles Bond Developmental Editor: Jill Franklin Cover Illustrator: James L. Barry Technical Reviewer: Don Frick Copyeditor: George Hale No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trade- marked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any informa- tion storage or retrieval system, without the prior written permission of the copyright owner and the publisher. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. CONTENTS Introduction Chapter 1: Digital Forensics Overview Chapter 2: Linux Overview Chapter 3: Extracting Evidence from Storage Devices and Filesystems Chapter 4: Directory Layout and Forensic Analysis of Linux Files Chapter 5: Investigating Evidence from Linux Logs Chapter 6: Reconstructing System Boot and Initialization Chapter 7: Examination of Installed Software Packages Chapter 8: Identifying Network Configuration Artifacts Chapter 9: Forensic Analysis of Time and Location Chapter 10: Reconstructing User Desktops and Login Activity Chapter 11: Forensic Traces of Attached Peripheral Devices Afterword Appendix A: File and Directory List for Digital Investigators The chapters in red are included in this Early Access PDF. Practical Linux Forensics (Early Access) © 2021 by Bruce Nikkel IN TRODUCTION Welcome to Practical Linux Forensics: A Guide for Digital Investigators. This book covers a variety of methods and techniques for find­ ing and analyzing digital evidence found on modern Linux systems. Among digital forensic inves­ tigators, the phrase Linux forensics may have one of two meanings. In one case, it refers to using Linux as a dig­ ital forensics platform to perform acquisition or anal­ ysis of any target system under investigation (which could be Windows, Mac, Linux, or any other operat­ ing system). In this book, however, Linux forensics refers to analyzing or examining a suspect Linux sys­ tem as the target of an investigation (independent of the platform or tools used). I will focus on identify­ ing common artifacts found on various Linux distri­ butions (distros) and how to analyze them in the con­ text of a forensic investigation. The forensic analysis Practical Linux Forensics (Early Access) © 2021 by Bruce Nikkel methods described in this book are independent of the tools used and will benefit users of FTK, X­Ways, EnCase, or any other forensic analysis tool suite. The tools I use in the examples and illustrations tend to be Linux­based, but the concepts remain fully tool inde­ pendent. Why I Wrote This Book In some ways, this book is a logical continuation of my first book, Practical Forensic Imaging. After performing a forensic acquisition of a system and securing a drive image, analysis is the next step performed in a typical digital forensic investigation. This book dives into the technical details of analyzing forensic images of Linux systems. There are many books on Windows and even Mac forensic analysis, but few books focus on the analysis of a Linux system as the target of an inves­ tigation. Even fewer focus specifically on postmortem (dead disk) analysis of modern Linux installations. I’ve been hearing digital forensic investiga­ tors in the community increasingly comment: “We are starting to get more Linux images in our lab, but we don’t know exactly what to look for...”. Such comments are coming both from forensic labs in the private sector (corpo­ rations) and the public sector (law enforcement). This book is intended to provide a resource that addresses this growing area of interest. It will help forensic investigators find and extract digital evidence found on Linux sys­ tems, reconstruct past activity, draw logical conclusions, and write compre­ hensive forensic evidence reports of their analysis. Another reason for writing this book is out of personal interest and motivation to better understand the internals of modern Linux systems. Over the past decade, significant advancements in Linux distributions have changed how Linux forensic analysis is performed. I teach classes in both digital forensics and Linux at the Bern University of Applied Sciences in Switzerland, and writing this book has helped me stay current on those top­ ics. Finally, I wrote this book because doing technical research and writing is fun and interesting. Writing is a learning process for me as an author, and I find myself constantly filling gaps in my knowledge that I didn’t realize ex­ isted. How This Book Is Unique This book was written as a guide for digital forensic investigators using any forensic analysis platform or tool. There is no requirement to use Linux as a platform or to use Linux­based tools. The book is intended to be a useful resource even for people using commercial digital forensic analysis tools on 2 Introduction Practical Linux Forensics (Early Access) © 2021 by Bruce Nikkel Windows or Mac, as long as those tools support the analysis of Linux arti­ facts. This book is Linux distribution agnostic. There is no favoritism toward any particular distro and the most popular Linux distributions are used across all the examples. The research, testing, and examples used in this book have been conducted primarily with four Linux distribution families and derivatives: Debian (including Ubuntu), Fedora (including Red Hat), SUSE, and Arch Linux. These four distributions are the basis for the vast majority of Linux systems in use today and are the core focus of this book. Whenever possible I try to describe concepts that are distro independent and consistent across most Linux distributions. However, many forensic artifacts are distribution specific and still need to be explained. Those are covered as well, but not as comprehensively. This book is also architecture independent. The concepts here should apply to Linux systems installed on any CPU architecture or hardware sys­ tem. The examples provided tend to focus on the 64­bit x86 PC (Intel and AMD) platform, with additional references to ARM­based Raspberry Pi sys­ tems. I might mention certain hardware peculiarities if they affect the digital forensics process in some way. Another aspect of this book is the discussion of Linux systems with a variety of uses and purposes. I cover methods for investigating both Linux server systems as well as Linux desktop systems. A wide range of scalability is assumed, and analysis techniques are applicable from tiny embedded Linux systems and Raspberry Pis, all the way up to large server clusters and Linux­ based mainframes. The assumption throughout this book is that we are performing a post­ mortem forensic analysis on a drive image, also known as dead disk forensics. Many books cover incident response and analysis of live Linux systems using commands while logged in to a running system. This book doesn’t cover live systems and assumes that a drive image has been acquired in a forensically sound manner or that a drive is safely attached to an examination machine with a forensic write blocker. That said, everything in this book will also be useful in the context of live system incident response. This book avoids going into too much depth on fringe or rare topics. In some cases, obscure topics might be mentioned and references provided, but the focus remains on covering the most popular Linux distributions, hardware architectures, and system applications. This book tries to remain non­political and non­religious about technol­ ogy. In the community there are often strong opinions about which technol­ ogy is better or worse, which licences are good or bad, which tech companies are altruistic or evil, and so on. I make a deliberate effort to avoid praising or criticizing any particular technology or company and avoid providing my personal opinions unless they are relevant to digital forensics. This combination of factors provides a book that is unique in the mar­ ketplace of digital forensics books, especially among those covering topics related to forensically analyzing Linux systems.