DFIR-Notes
Linux Forensics
Linux Forensics
  • Linux Memory Forensics
  • Linux Forensics Logs
    • Linux Forensics dirs
  • Linux Forensics Commands
  • Linux Forensics Tools
Powered by GitBook
On this page
  • 1. / - Root Directory
  • 2. /bin - Binary Directory
  • 3. /sbin - System Binaries
  • 4. /etc - Configuration Files
  • 5. /dev - Device Files
  • 6. /proc - Process Information
  • 7. /sys - System Information
  • 8. /home - User Home Directories
  • 9. /root - Root User's Home Directory
  • 10. /var - Variable Data
  • 11. /tmp - Temporary Files
  • 12. /usr - User Binaries and Libraries
  • 13. /lib - System Libraries
  • 14. /media - Removable Media
  • 15. /mnt - Temporary Mount
  • 16. /opt - Optional Software
  • 17. /srv - Service Data
  • 18. /boot - Boot Files
  • 19. /run - Runtime Data
  • 20. /snap - Snap Packages
  • 21. /lost+found - Recovered Files
  • 22. /tmp vs /var/tmp
  1. Linux Forensics Logs

Linux Forensics dirs

Linux directories are organized in a hierarchical structure, starting from the root directory /. Each directory serves a specific purpose and is essential for the operating system's functionality. Her

1. / - Root Directory

  • Purpose: The top of the directory hierarchy.

  • Description: All files and directories in Linux are under the root directory. It contains critical subdirectories like /bin, /etc, and /home.

2. /bin - Binary Directory

  • Purpose: Contains essential user binaries (executables).

  • Description: This directory stores critical commands used by all users, such as ls, cp, mv, and cat. These are necessary for basic system operation

3. /sbin - System Binaries

  • Purpose: Contains system administration binaries.

  • Description: Commands like ifconfig, iptables, and reboot reside here. These are primarily for the root user or administrators.

4. /etc - Configuration Files

  • Purpose: Stores system-wide configuration files.

  • Description: Contains settings for the system and applications, such as:

    • /etc/passwd: User account information.

    • /etc/fstab: Disk and filesystem configurations.

    • /etc/network: Network configuration files.

5. /dev - Device Files

  • Purpose: Contains device files representing hardware.

  • Description: Files like /dev/sda (disk) and /dev/tty (terminals) allow the OS to interact with hardware.

6. /proc - Process Information

  • Purpose: Virtual filesystem providing process and system info.

  • Description: Contains files like /proc/cpuinfo (CPU details) and /proc/meminfo (memory usage). It's dynamically generated by the kernel.

7. /sys - System Information

  • Purpose: Provides information about devices and drivers.

  • Description: Used for interacting with the kernel and managing devices. For example, /sys/class/net provides details about network interfaces.

8. /home - User Home Directories

  • Purpose: Stores personal files for each user.

  • Description: Each user gets a directory like /home/username. It contains user-specific configurations, documents, and downloads.

9. /root - Root User's Home Directory

  • Purpose: Home directory for the root user.

  • Description: This is separate from /home and is only accessible to the root user. Used for administrative tasks.

10. /var - Variable Data

  • Purpose: Stores variable files.

  • Description: Contains files that change frequently, such as:

    • /var/log: System logs.

    • /var/spool: Print or mail queues.

    • /var/cache: Cache data.

11. /tmp - Temporary Files

  • Purpose: Stores temporary files.

  • Description: Applications and processes use this directory to store temporary data, which is cleared upon reboot.

12. /usr - User Binaries and Libraries

  • Purpose: Stores user applications and their dependencies.

  • Description: Subdirectories include:

    • /usr/bin: Non-essential binaries (e.g., nano, vim).

    • /usr/lib: Libraries for user binaries.

    • /usr/share: Shared resources like icons and documentation.

13. /lib - System Libraries

  • Purpose: Contains essential shared libraries.

  • Description: Stores libraries needed for binaries in /bin and /sbin. For example:

    • /lib/modules: Kernel modules.

14. /media - Removable Media

  • Purpose: Mount point for removable drives.

  • Description: When you plug in a USB drive or insert a CD, it's often mounted here under a subdirectory like /media/usb.

15. /mnt - Temporary Mount

  • Purpose: Mount point for temporary filesystems.

  • Description: Used by administrators to manually mount filesystems for troubleshooting or temporary access.

16. /opt - Optional Software

  • Purpose: Stores optional or third-party software.

  • Description: Applications installed outside the package manager often reside here.

17. /srv - Service Data

  • Purpose: Contains data for services.

  • Description: Used by servers to store service-related data, such as web server files or FTP server data.

18. /boot - Boot Files

  • Purpose: Contains bootloader and kernel files.

  • Description: Includes:

    • vmlinuz: Compressed Linux kernel.

    • initrd: Initial RAM disk image.

    • grub: Bootloader configuration files.

19. /run - Runtime Data

  • Purpose: Temporary files required during system runtime.

  • Description: Stores information like PID files and sockets. Data is cleared on reboot.

20. /snap - Snap Packages

  • Purpose: Stores installed snap packages.

  • Description: Used by the Snap package management system to manage containerized applications.

21. /lost+found - Recovered Files

  • Purpose: Stores files recovered after filesystem errors.

  • Description: Created during disk repairs and typically found in the root of each filesystem.

22. /tmp vs /var/tmp

  • /tmp: Cleared on reboot. Used for temporary, short-lived files.

  • /var/tmp: Persistent temporary files. Not cleared on reboot.

PreviousLinux Forensics LogsNextLinux Forensics Commands

Last updated 5 months ago