Coolest thing is seeing a Linux box through the lense of a timeline. Overlaying log data on top of filesystem metadata
1
Replying to @corey_harrell
@corey_harrell What's interesting is to try to map cmds in shell history to filesystem artifacts: pkg updates, file copies, archive unpacks.

Oct 30, 2012 · 1:39 PM UTC

2
Replying to @hal_pomeranz
@hal_pomeranz I'll keep that in mind when I set up my next test system. Exploiting Apache on a Linux box to see how it looks.
Replying to @hal_pomeranz
@hal_pomeranz Besides testing, I've been examining a few Linux boxes over past few months. Pretty interesting stuff
1
@corey_harrell Need to blog about this, but file timeline + user logins + cmd history tells an interesting story about system activity.