Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…
34
50
2
95
Daily Linux Forensics Trivia #6 - How can you determine when a Linux system was installed?
3
1
3
I'm going to give @stoney27 credit on this one-- his answer was "date on the device of the root file system". Since there is no standard artifact for install date on Linux systems, the creation date on the root directory (or "/lost+found") is generally used.

Sep 12, 2022 · 12:38 PM UTC

2
2
Note that on some Linux distros there is an installation log that you can find under /var/log or /root. That will give you a much more exact timeline, if present.
1
2
Some people use the creation dates on the host SSH keys (/etc/ssh/ssh_host_*). These are generally a good indicator for when the system was first booted, since they are usually generated automatically at first boot.
4
Replying to @hal_pomeranz @stoney27
Hal, is lost+found created when fsck is run so maybe not at installation?
1
lost+found gets created when the file system is created. fsck may place orphaned inodes into lost+found if it finds file system damage, but it does not create the directory.
1
more replies