DFSP # 397 - Linux Home Directory Files for DFIR

This week I'm talking about the linux file system from the point of view of a forensic analyst. In general, it's a good idea to have a solid working knowledge of the linux file system so you understand what directories hold what artifacts… Or if you're looking for a specific category of artifact, you at least have an idea of where you may find it. I will cover the home directory this week and breakdown the typical forensic artifacts you …

analyst artifacts dfir directory file files file system forensic general good home knowledge linux point solid system talking understand week working