Linux Forensics

Intro to Linux
This module establishes the foundational knowledge required for Linux forensics, covering virtualization environments, essential command-line operations, system file structures, and file permissions. Students learn to navigate the Linux operating system, understand directory hierarchies, and interpret permission models that are critical for identifying unauthorized access or privilege escalation during investigations.
 

Linux Scripting
Students develop automation skills using shell scripting to streamline repetitive forensic tasks and enhance investigation efficiency. The module covers scripting fundamentals, control structures, and practical applications for automating log parsing, batch file analysis, and evidence collection workflows that enable investigators to process large datasets more effectively.
 

File Analysis
This module teaches techniques for examining file metadata, recovering deleted or fragmented files through carving, and detecting hidden data using steganography analysis. Students learn to extract timestamps, ownership information, and file signatures, as well as reconstruct file fragments from unallocated space to recover evidence that attackers may have attempted to delete.
 

File Systems
Students explore Linux file system architectures including ext3, ext4, XFS, and others, learning to interpret inodes, superblocks, journal structures, and allocation bitmaps. The module covers how file systems store and organize data at a technical level, enabling investigators to identify file system anomalies, recover overwritten data, and understand how evidence may be hidden or corrupted.
 

Log Analysis
This module focuses on parsing and analyzing Linux system logs using command-line text manipulation tools like grep, sed, and awk. Students examine authentication logs, system event logs, application logs, and learn correlation techniques to identify patterns indicating security breaches, unauthorized access attempts, or system compromises, while understanding log retention and integrity maintenance.
 

User Activity
Students learn to investigate user behavior by examining shell history files, bash configuration files, scheduled tasks (cron jobs), user account artifacts, and login records. The module teaches techniques for identifying suspicious user actions, privilege escalation attempts, persistence mechanisms, and lateral movement indicators by analyzing user-specific files and system artifacts.
 

Network Forensics
This module covers network traffic capture and analysis using Wireshark, TShark, and tcpdump to investigate network-based incidents. Students learn to filter and inspect packet captures, identify malicious traffic patterns, detect command-and-control communications, analyze protocol anomalies, and reconstruct attacker actions from network evidence during intrusion investigations.
 

Live Analysis
 Students develop skills for conducting forensic examinations on running systems, including safe partition mounting techniques, volatile memory acquisition, hard drive cloning procedures, and real-time process analysis. The module emphasizes evidence preservation while extracting critical volatile data such as running processes, network connections, and memory contents that would be lost upon system shutdown.
 

Cyber Security
This module provides essential cybersecurity context for forensic investigations, covering common network protocols and their vulnerabilities, attack vectors including man-in-the-middle attacks, and Linux system hardening techniques. Students learn to recognize exploitation patterns, understand how attackers compromise systems, and identify security misconfigurations that may have enabled breaches.