I&#;x26;#;39;ve been doing Unix/Linux IR and Forensics for a long time. I logged into a Unix system for the first time in 1983. That&#;x26;#;39;s one of the reasons I love teaching FOR577[1], because I have stories that go back to before some of my students were even born that are still relevant today.

In SANS FOR577&#;x26;#;x5b;1&#;x26;#;x5d;, we talk about timelines on day 5, both filesystem and super-timelines. but sometimes, I want something quick and dirty and rather than fire up plaso, just to create a timeline of .bash&#;x26;#;x5f;history data, it is nice to just be able to parse them and, if timestamps are enabled, see them in a human-readable form. I&#;x26;#;39;ve had some students in class write scripts to do this and even had one promise to share it with me after class, but I never ended up getting it so I decided to write my own. This script takes the path to 1 or more .bash&#;x26;#;x5f;history files and returns a PSV (pipe separated values) list (on stdout) in the form: || where the is in ISO-8601 format (the one true date time format, but only to 1 sec resolution since that his the best that the .bash&#;x26;#;x5f;history file will give us). In a future version I will probably offer an option to change from PSV to CSV.

As I mention every time I teach FOR577, I have been a big fan of file integrity monitoring tools (FIM) since Gene Kim first released Tripwire well over 30 years ago. I’ve used quite a few of them over the years including tripwire, OSSEC, samhain, and aide, just to name a few. For many years, I used the fcheck Perl script (by Michael A. Gumienny) that was available as an apt package on Ubuntu because it was lightning fast. Unfortunately, sometime between Ubuntu 16.04 and Ubuntu 20.04 (my memory f...

This week, it&#;x26;#;39;s SANSFIRE[1]! I&#;x26;#;39;m attending the FOR577[2] training ("Linux Incident Response &#;x26; Threat Hunting"). On day 2, we covered the different filesystems and how data is organized on disk. In the Linux ecosystem, most filesystems (ext3, ext4, xfs, ...) support "extended file attributes", also called "xattr". It&#;x26;#;39;s a file system feature that enables users to add metadata to files. These data is not directly made available to the user and may contain anything related to the file (ex: the author&#;x26;#;39;s name, a brief description, ...). You may roughly compare this feature to the Alternate Data Stream (ADS) available in the Windows NTFS filesystem.

New tool: immutable.py, Author: Jim Clausing

Copy on Write filesystems prevent some interesting situations for incident response and digital forensics. This article looks at file creation and deletion.

A guide to using Elasticsearch and Kibana containers to rapidly analyse complex Linux logs, such as the auditd log files.

New tool: le-hex-to-ip.py, Author: Jim Clausing