Unit 4: Linux, Mac and Network Forensics - Subjective Questions

Volatile data is information that is lost when the system loses power or is rebooted. Non-volatile data persists across reboots and power cycles.

Volatile data examples in Linux:

• Contents of RAM (/proc/kcore, process memory)
• Running processes (ps, /proc)
• Network connections (netstat, ss)
• Logged-in users (who, w)
• ARP cache, routing tables
• Open files and sockets (lsof)
• Kernel modules loaded (lsmod)

Non-volatile data examples in Linux:

• Files on disk (ext4, XFS, Btrfs partitions)
• Log files under /var/log
• Configuration files under /etc
• User home directories, bash history
• Swap partition contents

Order of Volatility (RFC 3227): Evidence should be collected from most volatile to least volatile:

1. CPU registers, cache
2. RAM / memory
3. Network state (connections, ARP)
4. Running processes
5. Disk / filesystem
6. Remote logging, archival media

Collecting in this order ensures that the most fragile evidence is captured before it disappears, preserving maximum forensic value and maintaining the integrity of the investigation.

The Sleuth Kit (TSK) is an open-source collection of command-line tools used to analyze disk images and recover files from them. It supports filesystems such as NTFS, FAT, ext2/3/4, HFS+, and UFS. Autopsy is the graphical front-end built on top of TSK.

Workflow: An investigator acquires a bit-by-bit image (e.g., using dd), verifies its hash, and then runs TSK tools against the image without modifying the original evidence.

Key TSK tools:

• mmls – Displays the partition layout / volume system of a disk image, showing partition offsets.
• fsstat – Displays general details about a filesystem (type, block size, inode ranges, volume label).
• fls – Lists files and directory names, including deleted entries, from a filesystem image.
• istat – Displays metadata about a specific inode (timestamps, size, allocated blocks).
• icat – Extracts the contents of a file by its inode number.
• blkls / blkcat – Extract or view data units (blocks), including unallocated space for carving.

Example usage:
bash
mmls disk.img
fls -r -o 2048 disk.img
icat -o 2048 disk.img 128 > recovered_file

TSK is powerful for timeline analysis, deleted file recovery, and metadata examination, all while preserving evidence integrity.

Volatility is an open-source memory forensics framework used to extract digital artifacts from volatile memory (RAM) dumps. It helps investigators uncover running processes, network connections, injected code, and malware that leave no trace on disk.

Process:

1. Acquire memory using tools like LiME, AVML, FTK Imager, or winpmem.
2. Identify the profile – In Volatility 2, the profile (e.g., Win7SP1x64, LinuxUbuntu_x64) tells the framework the OS type and kernel structures. Volatility 3 auto-detects using symbol tables.
3. Run plugins against the memory image to extract artifacts.
4. Correlate findings with disk and network evidence.

Importance of profiles: Memory layout differs by OS and kernel version. Selecting the wrong profile causes Volatility to misinterpret data structures and produce incorrect or no results.

Commonly used plugins:

• pslist / pstree – Lists running processes and parent-child relationships.
• psscan – Scans for hidden/terminated processes (detects rootkits).
• netscan / connections – Displays network connections and sockets.
• dlllist – Lists loaded DLLs for a process.
• malfind – Detects injected code / hidden executable memory regions.
• hashdump – Extracts password hashes from memory.

Example:
bash
vol.py -f memory.raw --profile=Win7SP1x64 pslist
vol.py -f memory.raw --profile=Win7SP1x64 malfind

PhotoRec is an open-source data recovery tool (bundled with TestDisk) that recovers lost files including photos, videos, documents, and archives from hard disks, memory cards, and other storage media.

File carving mechanism:

• PhotoRec ignores the filesystem metadata entirely and works directly on the raw data.
• It searches for known file signatures (magic numbers / headers and footers). For example, JPEG files start with \xFF\xD8\xFF and end with \xFF\xD9.
• When a signature is found, PhotoRec reconstructs the file by reading contiguous data blocks until the footer or expected size is reached.

Difference from traditional recovery:

Key advantages:

• Filesystem-independent, works even when the partition table is corrupted or the drive is reformatted.
• Supports hundreds of file formats.

Limitation: Since it does not use metadata, original filenames, folder structure, and timestamps are typically lost, and heavily fragmented files may not be fully reconstructed.

Mac forensics deals with the acquisition and analysis of evidence from Apple macOS devices. It has unique characteristics due to Apple's proprietary filesystems, encryption, and system design.

Filesystems:

• HFS+ (Hierarchical File System Plus) – older Macs.
• APFS (Apple File System) – modern default, optimized for SSDs, supports snapshots, cloning, and strong encryption.

Important macOS artifacts:

• Property list (.plist) files – Store configuration and user settings (XML or binary format).
• /Users/<user>/Library/ – Contains application data, caches, preferences.
• Unified Logs – System and app logs (log show command).
• FSEvents – Records filesystem changes (useful for timeline reconstruction).
• Spotlight metadata (.spotlight-V100) – File indexing information.
• Keychain – Stores credentials (encrypted).
• quarantine attributes – Track downloaded files (com.apple.quarantine).
• Recent items, browser history, mail databases.

Challenges:

• FileVault 2 full-disk encryption requires the user password or recovery key.
• APFS encryption and snapshots complicate imaging.
• T2 security chip / Apple Silicon enforce hardware encryption, making physical acquisition difficult.
• SIP (System Integrity Protection) restricts access to system areas.
• Proprietary formats require specialized parsing tools (e.g., BlackLight, Cellebrite, macOS-specific parsers).

Network forensics is the branch of digital forensics concerned with the capture, recording, and analysis of network traffic and events to detect intrusions, gather legal evidence, and investigate security incidents.

Objectives:

• Detect and investigate security breaches and intrusions.
• Identify the source and method of an attack.
• Reconstruct events and attacker activity.
• Collect legally admissible evidence.
• Support incident response and threat intelligence.

Two common approaches:

1. Catch-it-as-you-can:

• All packets passing through a monitoring point are captured and stored for later analysis.
• Requires large storage capacity.
• Analysis is done in batch mode afterward.
• Provides complete data but is storage-intensive.

2. Stop-look-and-listen:

• Each packet is analyzed in memory in real time, and only certain information or packets of interest are saved.
• Requires less storage but more processing power.
• Faster real-time detection but may miss data not initially deemed relevant.

Key characteristic: Because network data is highly volatile, network forensics often requires proactive capture, as traffic cannot be retrieved once it has passed unless recorded.

Logging fundamentals:
Logs are time-stamped records of events generated by systems, applications, and network devices. Effective logging is the foundation of network forensics.

Key logging principles:

• Completeness – Capture sufficient detail (source/destination IPs, ports, timestamps, user IDs).
• Accuracy & time synchronization – Use NTP to synchronize clocks so events across devices can be correlated.
• Retention – Store logs long enough to support investigations (compliance-driven).
• Integrity – Protect logs from tampering using write-once storage, hashing, or centralized log servers.
• Centralization – Aggregate logs (e.g., via syslog, SIEM) for correlation.

Common log sources: Firewalls, IDS/IPS, routers/switches, web servers, DNS servers, authentication servers, endpoints.

Network Forensic Readiness (NFR):
NFR is the state of being prepared to collect, preserve, and analyze digital evidence before an incident occurs, maximizing the ability to use evidence while minimizing investigation cost.

Importance:

• Faster response – Evidence is already being collected when an incident occurs.
• Legal admissibility – Proper chain of custody and integrity controls in place.
• Cost reduction – Reduces effort and time of investigations.
• Deterrence – Knowledge of monitoring discourages insider threats.
• Regulatory compliance – Meets legal and industry requirements (PCI-DSS, GDPR, HIPAA).

Event correlation is the process of analyzing and relating multiple events from different sources to identify meaningful patterns, detect security incidents, and reconstruct the sequence of an attack. It transforms large volumes of raw log data into actionable insight.

Why it is needed: A single log entry may be harmless, but correlated across sources it can reveal a coordinated attack (e.g., failed logins + privilege escalation + data exfiltration).

Types of event correlation techniques:

• Same-platform correlation – Correlates events from the same OS/platform.
• Cross-platform correlation – Correlates events across different platforms and devices.
• Rule-based correlation – Uses predefined if-then rules to trigger alerts.
• Field-based correlation – Compares specific fields (IP, username, port) across events.
• Statistical correlation – Uses mathematical/statistical models to detect anomalies from baselines.
• Time (temporal) correlation – Relates events based on their timestamps and sequence.
• Automatic/vulnerability-based correlation – Maps events against known vulnerabilities.
• Profile/fingerprint correlation – Matches events against known attack signatures.
• Route correlation – Traces the path of an attack across the network.

Correlation approaches:

• Graph-based – Represents causal relationships.
• Neural network / AI-based – Learns patterns for anomaly detection.
• Codebook-based – Uses a matrix of events and causes.

Effective correlation, usually performed by SIEM systems, reduces false positives and speeds up incident detection.

Indicators of Compromise (IoCs) are forensic artifacts or pieces of evidence that indicate a system or network has been breached or is under attack. They act as digital "clues" used for detection and threat intelligence.

Categories of IoCs:

• Network-based IoCs – Malicious IPs, domains, URLs, unusual ports, C2 (command-and-control) traffic.
• Host-based IoCs – Malicious file hashes (MD5/SHA256), registry changes, suspicious processes, mutexes.
• Behavioral IoCs – Abnormal user behavior, unusual login times, privilege escalation.

Identifying IoCs from network logs:

• Unusual outbound traffic – Large data transfers to unknown external IPs (possible exfiltration).
• Connections to known malicious IPs/domains – Matched against threat intelligence feeds.
• Beaconing – Regular, periodic connections to a single external host (C2 communication).
• Anomalous DNS queries – High volume of NXDOMAIN responses or DNS tunneling.
• Traffic on non-standard ports – e.g., encrypted traffic over port 80.
• Geographic anomalies – Logins from unexpected countries.
• Repeated failed authentication – Brute-force attempts.
• Port scanning patterns – Sequential connection attempts across many ports.

Example log observation:

10.0.0.5 -> 185.220.101.4:443 every 60s (beaconing to known Tor exit node)

This periodic connection to a flagged IP is a strong network IoC indicating possible C2 activity. IoCs are often shared in standard formats such as STIX/TAXII and used in SIEM/IDS rules.

Investigating network traffic involves capturing, filtering, and analyzing packets to reconstruct communications, detect malicious activity, and extract evidence.

General process:

1. Capture – Record traffic at a strategic point (SPAN port, TAP, or host interface).
2. Filter – Reduce noise using capture/display filters to focus on relevant traffic.
3. Analyze protocols – Examine headers and payloads across TCP/IP layers.
4. Reconstruct sessions – Follow TCP streams to rebuild conversations, files, or transfers.
5. Identify anomalies – Look for IoCs, malformed packets, or suspicious flows.
6. Document & preserve – Save captures (.pcap) with hashes for evidence integrity.

tcpdump:

• Command-line packet capture tool, lightweight and ideal for remote/headless systems.
• Example: tcpdump -i eth0 -w capture.pcap host 192.168.1.10
• Uses BPF (Berkeley Packet Filter) syntax for filtering.

Wireshark:

• GUI-based protocol analyzer with deep inspection of hundreds of protocols.
• Features: display filters (http.request, ip.addr==x.x.x.x), Follow TCP Stream, Statistics (Conversations, Protocol Hierarchy), Export Objects to extract transferred files.
• Useful for detailed forensic analysis of captured .pcap files.

Typical workflow: Capture with tcpdump on a server, then analyze the .pcap in Wireshark for detailed inspection. Together they provide both efficient capture and powerful analysis capabilities.

SIEM (Security Information and Event Management) is a centralized solution that collects, aggregates, normalizes, and correlates log and event data from across an organization's infrastructure to provide real-time security monitoring, detection, and analysis.

Core capabilities:

• Log collection & aggregation – Gathers logs from firewalls, servers, endpoints, IDS/IPS, applications.
• Normalization – Converts diverse log formats into a common structure.
• Event correlation – Applies rules and analytics to link related events and detect threats.
• Real-time alerting – Generates alerts when suspicious patterns are detected.
• Dashboards & visualization – Provides an overview of security posture.
• Reporting & compliance – Produces reports for PCI-DSS, HIPAA, GDPR, etc.
• Long-term storage & forensics – Retains logs for historical investigation.

How SIEM helps in incident detection and examination:

1. Detection – Correlation rules and anomaly detection identify threats (e.g., brute force, lateral movement) that individual devices would miss.
2. Prioritization – Assigns severity/risk scores to reduce alert fatigue.
3. Investigation – Analysts pivot through correlated events and drill down into raw logs to reconstruct the incident timeline.
4. Threat hunting – Query historical data for IoCs.
5. Response support – Integrates with SOAR for automated response.

Examples of SIEM tools: Splunk, IBM QRadar, ArcSight, Elastic (ELK) Security, Microsoft Sentinel, LogRhythm.

By providing a single pane of glass, SIEM greatly accelerates the detection, examination, and response phases of the incident-handling lifecycle.

Wireless networks are vulnerable to a range of attacks due to their broadcast nature. Monitoring and detecting these attacks is a key part of network forensics.

Common wireless attacks:

• Rogue Access Point – An unauthorized AP connected to the network, offering an entry point.
• Evil Twin – A malicious AP mimicking a legitimate SSID to lure users.
• Deauthentication / Disassociation attack – Sends forged deauth frames to disconnect clients (often precursor to capturing handshakes).
• WPA/WPA2 handshake capture & cracking – Capturing the 4-way handshake to brute-force the passphrase.
• Man-in-the-Middle (MitM) – Intercepting traffic between client and AP.
• Jamming / RF interference – Denial of service via signal disruption.
• KRACK – Exploits WPA2 key reinstallation.
• War driving – Scanning for open/vulnerable networks.

Monitoring and detection techniques:

• Wireless IDS/IPS (WIDS/WIPS) – Detect rogue APs, deauth floods, and anomalies.
• Monitoring management frames – A high rate of deauthentication/disassociation frames signals an attack.
• RF spectrum analysis – Detects jamming and interference.
• SSID/BSSID monitoring – Detects evil twins (same SSID, different/duplicate BSSID).
• Signal strength anomalies – Sudden new strong signals may indicate rogue APs.
• Tools – Kismet, Aircrack-ng suite (airodump-ng), Wireshark with monitor mode, NetStumbler.

Example detection: A flood of 802.11 deauthentication frames from a single MAC address captured in airodump-ng indicates an ongoing deauthentication attack.

Collecting volatile data from a live Linux system must be done quickly and with minimal impact, following the order of volatility. Ideally, trusted static binaries are used to avoid relying on a potentially compromised system.

Important commands and captured artifacts:

Memory acquisition:

• Use LiME (Linux Memory Extractor) or AVML to dump full RAM: insmod lime.ko "path=/mnt/mem.lime format=lime".

Best practices:

• Record all actions and timestamps for the chain of custody.
• Send output to external media or a network listener (e.g., using netcat) to avoid altering the disk.
• Compute hashes of collected data to preserve integrity.
• Prefer trusted external binaries over the host's binaries.

HFS+ (Hierarchical File System Plus) and APFS (Apple File System) are the two primary macOS filesystems. APFS replaced HFS+ as the default starting with macOS High Sierra (2017).

Comparison:

Forensic implications:

• APFS snapshots can preserve historical states of the filesystem, valuable for recovering deleted data and timeline analysis.
• APFS copy-on-write means old data blocks may persist, aiding recovery, but also complicating imaging.
• APFS containers with dynamic space sharing make partition analysis more complex than HFS+ fixed volumes.
• Nanosecond timestamps in APFS enable more precise timeline reconstruction.
• Strong native encryption in APFS makes acquisition harder without keys.
• Investigators need APFS-aware tools (e.g., newer versions of TSK, BlackLight, Cellebrite) since older HFS+ tools cannot parse APFS structures.

File signature-based carving is a data recovery technique that reconstructs files from raw data by recognizing unique byte patterns at the beginning (header/magic number) and sometimes the end (footer) of a file, independent of filesystem metadata.

How it works:

1. The tool scans raw disk/image data byte by byte.
2. When a known header signature is found, it marks the start of a potential file.
3. It reads data until a matching footer is found or a maximum size is reached.
4. The identified block is extracted and saved as a recovered file.

Common file signatures:

Advantages:

• Works even when the filesystem is corrupted or reformatted.
• Recovers deleted files whose metadata is lost.

Limitations:

• Fragmentation – Files split into non-contiguous blocks may not be fully recovered.
• No filenames/timestamps – Metadata is lost; generic names are assigned.
• False positives – Signatures may appear inside other files.

Tools such as PhotoRec, Foremost, and Scalpel implement signature-based carving.

Logs are the primary evidence source in network forensics. Different log types capture different aspects of activity.

Important log types and their forensic value:

• Firewall logs – Record allowed/denied connections, source/destination IPs and ports. Value: identify scanning, blocked attacks, and exfiltration attempts.
• IDS/IPS logs – Alert on signature or anomaly matches. Value: detect known attack patterns and intrusions.
• Web server logs (Apache/Nginx access & error logs) – Record HTTP requests, URLs, status codes, user agents. Value: detect web attacks (SQLi, XSS, directory traversal).
• DNS logs – Record domain resolution queries. Value: detect C2 domains, DNS tunneling, and data exfiltration.
• DHCP logs – Map MAC addresses to assigned IPs over time. Value: attribute activity to specific devices.
• Authentication logs (/var/log/auth.log, Windows Security logs) – Record login successes/failures. Value: detect brute force and unauthorized access.
• Proxy logs – Record outbound web requests. Value: identify malicious downloads and user browsing.
• NetFlow / IPFIX – Metadata about flows (who talked to whom, when, how much). Value: traffic analysis and anomaly detection without full packet capture.
• Router/switch logs – Device events and configuration changes.
• VPN logs – Remote access sessions.

Key considerations:

• Time synchronization (NTP) across sources is essential for correlation.
• Logs must be centralized and integrity-protected for reliable evidence.
• Combining multiple log types enables full event correlation and timeline reconstruction.

The incident response lifecycle (based on NIST SP 800-61) provides a structured approach to handling security incidents. Forensics plays a supporting role across the phases.

Phases:

1. Preparation:

• Establish policies, tools, and a trained team.
• Forensic readiness – Configure logging, deploy monitoring/SIEM, prepare acquisition tools.

2. Detection & Analysis:

• Identify that an incident has occurred using IDS/IPS, SIEM alerts, and IoCs.
• Forensics role – Analyze logs and network traffic, correlate events, determine scope and impact, confirm the incident.

3. Containment:

• Limit the spread (isolate hosts, block IPs).
• Forensics role – Capture volatile data (memory, network state) and images before systems are altered, preserving evidence.

4. Eradication:

• Remove the threat (malware, backdoors, compromised accounts).
• Forensics role – Identify all affected systems and root cause using artifact and malware analysis.

5. Recovery:

• Restore systems to normal operation and monitor for reinfection.
• Forensics role – Verify systems are clean; continue monitoring for IoCs.

6. Post-Incident / Lessons Learned:

• Document the incident, improve defenses, and prepare reports.
• Forensics role – Produce the final forensic report with a defensible chain of custody for legal/regulatory use.

Key point: Forensic evidence must be collected in accordance with the order of volatility and with proper chain-of-custody documentation to remain admissible.

IDS vs IPS:

Detection methodologies:

1. Signature-based detection:

• Compares traffic against a database of known attack signatures/patterns.
• Pros: High accuracy for known threats, low false positives.
• Cons: Cannot detect new/zero-day attacks; requires constant signature updates.

2. Anomaly-based detection:

• Builds a baseline of normal behavior and flags deviations from it.
• Pros: Can detect unknown/zero-day attacks and insider threats.
• Cons: Higher false positive rate; requires training and tuning.

3. Stateful protocol analysis (bonus):

• Compares observed protocol behavior against expected/vendor-defined norms.

Forensic relevance: IDS/IPS logs provide critical evidence of attack attempts, timestamps, and IoCs, which are correlated in SIEM for investigation. A combination of signature and anomaly detection provides the broadest coverage.

Linux memory forensics captures and analyzes RAM to uncover running processes, network connections, malware, and other volatile artifacts.

Step 1: Memory Acquisition

• Use LiME (Linux Memory Extractor), a loadable kernel module:
  bash
  sudo insmod lime.ko "path=/media/usb/mem.lime format=lime"

• Alternatively use AVML (Microsoft's tool) which works without compiling for a specific kernel.

• Dump memory to external/removable media to avoid altering the target disk.

• Compute a hash (SHA-256) of the dump immediately for integrity.

Step 2: Build/Obtain a Profile (Volatility 2)

• Linux profiles are kernel-specific. Create one using dwarfdump and the kernel's System.map, packaging it into a ZIP placed in Volatility's linux profiles directory.
• Volatility 3 uses ISF symbol tables and often auto-detects, simplifying this step.

Step 3: Analysis with Volatility plugins

• linux_pslist / linux_pstree – List running processes.
• linux_psaux – Show process command-line arguments.
• linux_netstat – Network connections.
• linux_lsof – Open file descriptors.
• linux_bash – Recover bash command history from memory.
• linux_check_syscall / linux_check_modules – Detect rootkits/hooking.
• linux_malfind – Detect injected/malicious code.

Example:
bash
vol.py -f mem.lime --profile=LinuxUbuntu2004x64 linux_pslist
vol.py -f mem.lime --profile=LinuxUbuntu2004x64 linux_bash

Step 4: Correlation & Reporting

• Correlate memory findings with disk and network evidence.
• Document all steps and maintain chain of custody.

Analyzing a .pcap file to detect data exfiltration involves systematically examining traffic patterns for signs that sensitive data is leaving the network.

Analysis steps:

1. Get an overview:

   • In Wireshark, use Statistics → Protocol Hierarchy and Conversations to see volume distribution and top talkers.

2. Identify large outbound transfers:

   • Sort conversations by bytes sent to external IPs. Large uploads to unknown hosts are a red flag.

3. Check destinations against threat intelligence:

   • Verify external IPs/domains against blocklists and known malicious feeds.

4. Look for exfiltration channels:

   • DNS tunneling – Abnormally long or high-frequency DNS TXT/A queries (dns.qry.name with encoded data).
   • HTTP/HTTPS POST – Large POST bodies to suspicious endpoints (http.request.method == "POST").
   • ICMP tunneling – Unusually large or frequent ICMP packets carrying payload.
   • FTP/SFTP transfers – Outbound file uploads.

5. Detect beaconing/C2:

   • Regular periodic connections (fixed intervals) to a single host suggest C2-controlled exfiltration.

6. Reconstruct content:

   • Use Follow TCP Stream and File → Export Objects to extract transferred files.

7. Check for encryption/encoding:

   • Base64-encoded payloads or unexpected TLS to non-standard destinations.

Key indicators (IoCs):

• Unusual outbound data volume, especially during off-hours.
• Data sent to unfamiliar geographic locations.
• Non-standard ports or protocol misuse.
• Long, encoded DNS queries.

Documentation: Record findings, extract relevant packets, hash the .pcap, and maintain chain of custody for the evidence. Confirming exfiltration typically requires correlating pcap evidence with endpoint and log data in a SIEM.