Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…
34
50
2
95
Daily Linux Forensics Trivia #6 - How can you determine when a Linux system was installed?
3
1
3
I'm going to give @stoney27 credit on this one-- his answer was "date on the device of the root file system". Since there is no standard artifact for install date on Linux systems, the creation date on the root directory (or "/lost+found") is generally used.
2
2
Hal, is lost+found created when fsck is run so maybe not at installation?
1
Replying to @cartoonlord @stoney27
lost+found gets created when the file system is created. fsck may place orphaned inodes into lost+found if it finds file system damage, but it does not create the directory.

Sep 14, 2022 · 7:59 AM UTC

1
Replying to @hal_pomeranz @stoney27
Thanks for the clarification