> For the complete documentation index, see [llms.txt](https://mahmoud-shaker.gitbook.io/dfir-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands.md). # Linux Forensics Commands ### 1. File and Metadata Analysis * dentifies the type of a file: ``` file suspicious_file ``` * Extracts human-readable strings from binary files: ``` strings binary_file ``` * Displays detailed file metadata, including timestamps: ``` stat file ``` * Extracts metadata from multimedia files: ``` exiftool image.jpg ``` * Creates a hex dump of a file: ``` xxd file ``` * Displays disk usage of a directory or file: ``` du -sh /var/log ``` * Lists mounted filesystems: ``` mount ``` * Unmounts a filesystem: ``` umount /mnt ``` * Shows block devices in a tree structure: ``` lsblk ``` * Views logs from `systemd` systems : ``` journalctl -u sshd ``` * provides detailed metadata and statistics about a packet capture (PCAP) file ``` capinfos ``` ### jq filters

jq
cat logs.json | jq '.events[] | select(.status == "failed")'
cat logs.json | jq '.events[] | .source_ip'

### 2. System Information Gathering * Hostname and OS details: ``` hostname uname -a cat /etc/os-release ``` * Kernel version and architecture: ``` uname -r arch ``` * System uptime and load: ``` uptime w ``` ### 3. User Information * Logged-in users and history: ``` who last history lastlog passwd -S username ``` * Check sudoers file: ``` cat /etc/sudoers ``` ### 4. Process Investigation * List running processes: ``` ps aux top htop crontab -l ``` * Identify network-related processes: ``` netstat -tunap lsof -i ``` * Lists open files by processes ``` lsof -p PID ``` * Displays memory maps of processes ``` pmap PID ``` * Traces system calls made by a process. ``` strace -p PID ``` ### 5. File and Directory Investigation * List directory contents: ``` ls -alh ``` * List hidden files: ``` ls -a ``` * Search for recent file modifications: ``` find / -type f -mtime -5 2>/dev/null ``` * Find files with specific extensions: ``` find / -type f -name "*.sh" ``` ### 6. Network Investigation * Active network connections: ``` ss -tunap netstat -plant ``` * Network interface information: ``` ip addr show ifconfig ``` * DNS resolutions: ``` cat /etc/resolv.conf ``` * Capture packets with tcpdump: ``` tcpdump -i eth0 -w capture.pcap ``` * Analyze packets with tshark: ``` tshark -r capture.pcap tshark -n -r packets.pcap -Tfields -e ip.srce -e tcp.srcport -e ip.dst -e tcp.dstport | sort | unig -c ``` ### 7.Package and Service Analysis * List installed packages: ``` dpkg -l # For Debian-based systems rpm -qa # For Red Hat-based systems ``` * Running services: ``` systemctl list-units --type=service service --status-all ``` ### 8.Hashing and File Integrity * Calculate file hash: ``` sha256sum filename md5sum filename ``` * Compare file hashes: ``` diff <(sha256sum file1) <(sha256sum file2) ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.