Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…
34
50
2
95
Replying to @hal_pomeranz @WWHackinFest
Daily Linux Forensics Trivia #6 - How can you determine when a Linux system was installed?

Sep 11, 2022 · 2:42 PM UTC

3
1
3
I'm going to give @stoney27 credit on this one-- his answer was "date on the device of the root file system". Since there is no standard artifact for install date on Linux systems, the creation date on the root directory (or "/lost+found") is generally used.
2
2
Note that on some Linux distros there is an installation log that you can find under /var/log or /root. That will give you a much more exact timeline, if present.
1
2
Some people use the creation dates on the host SSH keys (/etc/ssh/ssh_host_*). These are generally a good indicator for when the system was first booted, since they are usually generated automatically at first boot.
4
Replying to @hal_pomeranz @WWHackinFest
Check the date on the device of root filesystem?
Replying to @hal_pomeranz @WWHackinFest
As an auditor, I am interested in the answer