Unit 4: Linux, Mac and Network Forensics

Digital forensics on Unix-derived systems and networks extends the acquire-preserve-analyse-report cycle to filesystems, live memory and traffic that no longer sit on a single seized disk. This unit hangs on the distinction between data that survives power loss and data that does not, and on the tools that recover each class.

• Order of volatility: Collect data in decreasing volatility — CPU registers/cache, RAM, network state, running processes, then disk, archives and backups.
• Chain of custody: Every image is hashed (MD5/SHA-256) at acquisition; identical hashes on re-verification prove integrity.
• Write-blocking: Work only on forensic copies; originals are mounted read-only or acquired via dd/dcfldd.
• Locard's principle: Every interaction leaves a trace — a logon, a packet, an inode change — which the examiner reconstructs.

II. Linux Forensics

Acquiring and interpreting evidence on ext/XFS systems and their memory.

Linux stores rich metadata in inodes and journals, and exposes live state through /proc and /sys, making both dead-box and live analysis productive.

A. Understand volatile and non-volatile data in Linux

Evidence divides by whether it survives shutdown.

• Volatile data: Lost on power-off; captured live before imaging.
  • Sources: RAM contents, ps/top process lists, netstat -antp connections, lsof open files, ARP cache, /proc/<pid>/ maps, logged-in users via w.
• Non-volatile data: Persists on storage across reboots.
  • Sources: ext4/XFS files, /var/log/ (syslog, auth.log, wtmp, btmp), .bash_history, cron jobs, /etc/passwd, timestamps (MAC times: modify, access, change).
• Capture rule: Live-acquire volatile artefacts first (image RAM), then power down and image the disk with dd if=/dev/sda of=disk.img bs=4M conv=noerror,sync.

B. Analyze filesystem images using The Sleuth Kit

The Sleuth Kit (TSK) is a command-line library that parses filesystem structures inside a raw image without mounting it.

• Layered tool naming: Prefix denotes the layer analysed.
  • mmls: partition (media-management) layout, reports sector offsets.
  • fsstat: filesystem details — block size, inode count, journal.
  • fls: lists files/directories, including deleted entries marked *.
  • istat: metadata for one inode (times, block pointers).
  • icat: extracts file content by inode number.
• Deleted-file recovery: fls -rd lists deleted names; unallocated inodes still pointing to blocks are recovered with icat.
• Timeline creation: fls -m + mactime builds a body file and a chronological MAC-time timeline.

mmls disk.img                    # find partition offset (e.g. 2048)
fls -o 2048 -r disk.img          # recursive file listing
icat -o 2048 disk.img 128 > out  # recover inode 128

• Autopsy: GUI front-end to TSK adding keyword search, hash sets and reporting.

C. Demonstrate memory forensics using Volatility & PhotoRec

Two complementary recovery targets: live RAM structures and lost files on disk.

1. Volatility (memory): Framework that parses a RAM dump against a profile of kernel structures.
   • Profile/symbols: imageinfo (v2) or an ISF symbol table (v3) identifies the OS build.
   • Key plugins: pslist/pstree (processes), psscan (hidden/exited via pool scanning), netscan (sockets), malfind (injected code), cmdline, dlllist.
   • Use case: Detect a process absent from pslist but present in psscan — evidence of rootkit unlinking.
2. PhotoRec (disk): File-carving tool ignoring the filesystem, matching data to known headers/footers.
   • Carving basis: Recognises signatures (JPEG FF D8, PDF %PDF) so it recovers files even when the directory table is destroyed.
   • Limitation: Fragmented files may carve incompletely; recovered files lose original names/timestamps.

vol.py -f mem.raw --profile=LinuxUbuntu2004x64 linux_pslist
photorec /d recovered/ /cmd disk.img search

III. Understand Mac Forensics

Evidence handling on APFS/HFS+ systems with Apple-specific artefacts.

macOS forensics targets a proprietary directory tree and databases that record user activity in detail.

A. Understand Mac forensics

Mac evidence lives in specific filesystem locations and plist/SQLite stores.

• Filesystems: APFS (default since 10.13) with snapshots and cloning; older HFS+ with a catalog B-tree.
• Property lists (plists): XML or binary config/state files under ~/Library/Preferences/; parsed with plutil or plistlib.
• User-activity artefacts:
  • Spotlight: .spotlight-V100 metadata indexes filenames and content.
  • Unified Logs: /var/db/diagnostics/ binary logs read with log show.
  • KnowledgeC.db / quarantine: SQLite databases recording app usage and downloaded-file origins (LSQuarantine).
• Encryption barrier: FileVault 2 (full-disk XTS-AES) requires the user password or recovery key before imaging yields plaintext.
• Acquisition: Target Disk Mode or a live image; System Integrity Protection restricts even root access to protected paths.

IV. Network Forensics

Reconstructing intrusions from traffic and logs rather than from a host disk.

Network forensics captures, records and analyses network events to discover the source of security incidents; evidence is transient, so readiness planning matters.

A. Understand network forensics

Defines the discipline and its two capture strategies.

• Definition: The forensic capture, recording and analysis of network packets and flows to detect and reconstruct attacks.
• 1. Catch-it-as-you-can: All packets stored to disk, analysed later — storage-heavy but complete.
• 2. Stop-look-and-listen: Packets analysed in memory, only selected data saved — lighter but lossy.
• Data sources: Full-packet captures (pcap), NetFlow/IPFIX flow records, firewall and IDS logs.

B. Logging fundamentals and network forensic readiness

Reliable evidence depends on logging designed before an incident occurs.

• Log types: Firewall, proxy, DNS, DHCP, web-server access logs, authentication logs.
• Syslog severities: Numeric 0 (emergency) to 7 (debug); facilities route messages by source.
• Time synchronisation: All devices use NTP so events correlate to a common clock — essential for ordering.
• Forensic readiness: Pre-defining what is logged, retention periods, secure centralised storage and tamper-evidence (hashing, WORM) so admissible evidence already exists when needed.
• Integrity: Forward logs off-host in real time; a compromised host's local logs are untrustworthy.

C. Summarize event correlation concepts

Correlation links individual events into a coherent attack narrative.

• Definition: Relating multiple log/alert entries across sources and time to reveal a pattern a single event hides.
• Correlation types:
  • Same-platform: Events from one device type.
  • Cross-platform: Firewall + IDS + host logs combined.
• Techniques: Rule-based (predefined conditions), field-based (matching IPs/users), statistical/anomaly-based, and time-window grouping.
• Example: A failed-logon burst (auth log) followed by a success then outbound transfer (firewall) correlates to a brute-force compromise.

D. Identify Indicators of Compromise (IoCs) from network logs

IoCs are observable artefacts signalling a breach.

• Network IoCs:
  • Malicious IPs/domains: Connections to known C2 endpoints.
  • Beaconing: Regular fixed-interval callbacks to one host.
  • DNS anomalies: Long random subdomains suggesting tunnelling/exfiltration.
  • Port/protocol mismatch: HTTP on a non-standard port, or plaintext where TLS is expected.
• Data volume: Unusual outbound byte counts indicating exfiltration.
• Sharing format: STIX/TAXII standardises IoC exchange between organisations.

E. Investigate network traffic

Packet analysis reconstructs what actually crossed the wire.

• Capture tools: tcpdump/Wireshark for packets; tshark for scripted extraction.
• Filtering: BPF capture filters vs. Wireshark display filters narrow the dataset.
• Stream reconstruction: "Follow TCP Stream" reassembles a session; NetworkMiner carves transferred files and credentials.
• Flow analysis: NetFlow summarises conversations (src, dst, ports, bytes) when full capture is impractical.

tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 443
tshark -r capture.pcap -Y "http.request" -T fields -e http.host

F. Perform incident detection and examination with SIEM tools

A SIEM centralises logs to detect and investigate incidents at scale.

• SIEM = SIM + SEM: Security Information Management (storage/reporting) plus Security Event Management (real-time correlation/alerting).
• Pipeline: Collect → normalise (common schema) → correlate (rules) → alert → dashboard/report.
• Detection: Correlation rules and anomaly baselines raise alerts; enrichment adds threat-intel context to matched IoCs.
• Examination: Analysts pivot across normalised fields to trace an alert to its root cause; retained raw logs support timeline rebuilds.
• Examples: Splunk, ELK/Elastic Security, IBM QRadar, Microsoft Sentinel.

G. Monitor and detect wireless network attacks

Wireless monitoring watches the RF layer for rogue and disruptive activity.

• Monitor mode: A capture card in monitor mode records 802.11 management/control/data frames (airodump-ng).
• Attack signatures:
  • Deauthentication attack: Flood of spoofed deauth frames forcing disconnects — a DoS and a prelude to handshake capture.
  • Rogue/Evil-twin AP: Unauthorised AP mimicking a legitimate SSID/BSSID to harvest credentials.
  • Karma/probe abuse: AP answering all probe requests to lure clients.
• Detection: WIDS compares seen BSSIDs against a whitelist, watches for duplicate SSIDs on different BSSIDs, and flags abnormal deauth/beacon rates.
• Evidence: Captured handshakes, frame timestamps and signal-strength triangulation locate the offending device.