Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…

Sep 6, 2022 · 1:31 PM UTC

34
50
2
95
Daily Linux Forensics Trivia #1 -- Name two places in the Linux file system where the file type is encoded. wildwesthackinfest.com/deadw…
1
8
6
Trivia Answer #1 — File type was originally only stored in the inode. It was later added to directory entries so that commands like “ls -F” would not have to read every inode in a directory in order to display the file type.
1
3
Load newest
Replying to @hal_pomeranz @WWHackinFest
Daily Linux Forensics Trivia #26 - Name three different logs where you can normally find a record of user logins.
2
1
Trivia Answer #26 - I should have been more specific here. I was looking for logs that track successful user logins over time and I was thinking of Syslog's LOG_AUTHPRIV stream (usually /var/log/auth.log or .../secure), the wtmp file, and the audit.log.
2
1
more replies
Daily Linux Forensics Trivia #28 - How do Chrome and Firefox web browser artifacts differ on Linux systems as compared to Windows/Mac?
2
1
4
The only thing different about web browser artifacts on Linux is their location. $HOME/.mozilla/firefox (Firefox) and $HOME/.config/chromium (Chrome) are the usual locations on Linux. Otherwise it's same SQLite databases, etc. Anything else would be crazy in terms of code re-use
1
1
1
more replies
Daily Linux Forensics Trivia #28 - True or False: XFS inode numbers are assigned sequentially.
1
Trivia Answer #28 - False. XFS allocates inodes on demand, and the inode number is assigned based on the inode’s position on the disk.
2
Replying to @hal_pomeranz @WWHackinFest
Daily Linux Forensics Trivia #29 - You are given a disk image of a Linux system. How do you determine which distro and version it is?
6
9
1
14
Trivia Answer #29 - Shout out to @Grabbi_it for chiming in with the answer. Mount your evidence and look at /etc/os-release, which should be there regardless of which distro you have been given.
1
2
4
more replies
Load more