# Linux Forensics Commands

### 1. File and Metadata Analysis

* dentifies the type of a file:

```
file  suspicious_file
```

* Extracts human-readable strings from binary files:

```
strings binary_file
```

* Displays detailed file metadata, including timestamps:

```
stat file
```

* Extracts metadata from multimedia files:

```
exiftool image.jpg
```

* Creates a hex dump of a file:

```
xxd file
```

* Displays disk usage of a directory or file:

```
du -sh /var/log
```

* Lists mounted filesystems:

```
mount
```

* Unmounts a filesystem:

```
umount /mnt
```

* Shows block devices in a tree structure:

```
lsblk
```

* Views logs from `systemd` systems : 

```
journalctl -u sshd
```

* provides detailed metadata and statistics about a packet capture (PCAP) file

```
capinfos <file.pcap>
```

### jq filters&#x20;

<pre><code><strong>jq
</strong><strong>cat logs.json | jq '.events[] | select(.status == "failed")'
</strong>cat logs.json | jq '.events[] | .source_ip'
</code></pre>

### 2.  System Information Gathering

* Hostname and OS details:

```
   hostname
   uname -a
   cat  /etc/os-release
```

* Kernel version and architecture:

```
   uname -r
   arch
```

* System uptime and load:

```
   uptime
   w
```

### 3. User Information

* Logged-in users and history:

```
    who
    last
    history
    lastlog
    passwd -S username
```

* Check sudoers file:

```
cat  /etc/sudoers
```

### 4. Process Investigation

* List running processes:

```
   ps aux
    top
    htop
    crontab -l
```

* Identify network-related processes:

```
    netstat -tunap
    lsof -i
```

* Lists open files by processes

```
lsof -p PID
```

* Displays memory maps of processes

```
pmap PID
```

* Traces system calls made by a process.

```
strace -p PID
```

### 5. File and Directory Investigation

* List directory contents:

```
ls -alh
```

* List hidden files:

```
   ls -a 
```

* Search for recent file modifications:

```
  find / -type f -mtime -5  2>/dev/null
```

* Find files with specific extensions:

```
 find / -type f -name "*.sh"
```

### 6. Network Investigation

* Active network connections:

```
   ss -tunap
  netstat -plant
```

* Network interface information:

```
  ip addr show
  ifconfig
```

* DNS resolutions:

```
 cat /etc/resolv.conf
```

* Capture packets with tcpdump:

```
 tcpdump -i eth0 -w capture.pcap
```

* Analyze packets with tshark:

```
    tshark -r capture.pcap
    tshark -n -r packets.pcap -Tfields -e ip.srce -e tcp.srcport -e ip.dst -e tcp.dstport | sort | unig -c
```

### 7.Package and Service Analysis

* List installed packages:

```
    dpkg -l   # For Debian-based systems
    rpm -qa   # For Red Hat-based systems
```

* Running services:

```
    systemctl list-units --type=service
    service --status-all
```

### 8.Hashing and File Integrity

* Calculate file hash:

```
   sha256sum filename
   md5sum filename
```

* Compare file hashes:

```
diff <(sha256sum file1) <(sha256sum file2)
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.