Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…
34
50
2
95
Daily Linux Forensics Trivia #13 - Your suspect claims they never connected their Linux laptop to their neighbor's WiFi network. What Linux artifact could you use to disprove this claim?

Sep 18, 2022 · 1:36 PM UTC

2
1
4
Trivia Answer #13 - On modern Linux distros, look in /var/lib/NetworkManager for dhclient-<GUID>-<NIC>.lease files. These are text files containing details of DHCP leases acquired. They are not normally cleaned up and may cover the entire lifetime of the equipment.
1
1
3
On older systems, look under /var/lib/dhc* for similar files.
2
Replying to @hal_pomeranz
top of my head: routing table. /proc/net/route? dhcp leases. (forgot the location) arp table. SSID/wireless history /etc/networkmanager (dependent on the OS)
1