O'Reilly logo

Mastering Python Forensics by Dr. Johann Uhrmann, Dr. Michael Spreitzenbarth

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Implementing Linux specific checks

In this section, we will describe how to implement some integrity checks to support the finding signs of system manipulation in Linux and similar (for example, BSD) systems.

These checks include the following:

  • Searching for anomalies in the local user management
  • Understanding and analyzing file metadata for special permissions and privileges
  • Using clustering algorithms on file metadata to get indicators on where to look deeper

Checking the integrity of local user credentials

The information about local users in Linux is mostly stored in two files: /etc/passwd and /etc/shadow. The latter is optional and all the information about local users—including the hashed password—was originally stored in /etc/passwd. Soon, it ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required