DFSP # 425 - SSH Forensics: Host-Based Artifacts

In the last episode on this topic, I covered SSH from a investigation point of view. I explained SSH and the artifacts that typically come up when your investigating. In this episode, we're getting into the triage methodology. This includes the artifacts targeted for a fast, but yet effective triage for notable SSH activity on a given host.

artifacts explained fast forensics host investigation methodology point ssh topic triage