Please enable JavaScript.
Coggle requires JavaScript to display documents.
🟦 Phase 9 : Evidence Collection - Coggle Diagram
🟦 Phase 9 : Evidence Collection
🟦 Phase 1: Evidence Collection (First Step)
🎯 Purpose of Evidence Collection
📌 Goal
Preserve digital evidence before changing the system
Collect facts about what happened
Identify attacker activity
Support investigation and legal requirements
Maintain chain of custody
📌 Why Evidence Collection is Important
System memory can disappear after reboot
Running processes can terminate
Network connections can close
Logs can rotate or be deleted
Malware can modify files
📌 Evidence Collection Principles
🔒 Preserve Original Evidence
Never modify original files
Work on forensic copies
⏱ Collect Volatile Data First
Information stored in memory
Information that disappears after shutdown
📝 Document Everything
What was collected
When collected
Who collected it
Which commands were executed
🟩 Enterprise Incident Response Preparation
🖥 Investigation Machine
Also called:
Forensic Workstation
Analysis Server
Purpose:
Store collected evidence
Analyze logs
Run forensic tools
Example:
Ubuntu Forensic Server
Security Onion
SANS SIFT Workstation
👤 Investigator Account
Create dedicated account
Command:
useradd ir_analyst
Set password:
passwd ir_analyst
Give required permissions:
usermod -aG sudo ir_analyst
Why:
Avoid using root directly
Maintain accountability
Track investigator actions
📁 Evidence Storage Location
Create evidence directory:
mkdir -p /evidence/case001
Recommended structure:
/evidence
/case001
/01_memory
/02_processes
/03_network
/04_logs
/05_filesystem
/06_hashes
/07_reports
Purpose:
Organized forensic collection
Easy investigation
Audit compliance
️⃣ Evidence Identification
🖥 System Information Collection
Purpose:
Identify affected Linux system
Collect hostname:
hostname
Collect full hostname:
hostnamectl
Output example:
server01.company.com
Why important:
Identify affected asset
Match CMDB records
🐧 Operating System Information
Command:
cat /etc/os-release
Example output:
NAME="Red Hat Enterprise Linux"
VERSION="9"
Collect kernel:
uname -r
Collect architecture:
uname -a
Why:
Understand vulnerable OS
Identify security patches
🕒 Date and Time Information
Command:
date
Collect timezone:
timedatectl
Why:
Timeline investigation
Correlate logs from different systems
👥 User Account Evidence
Collect users:
cat /etc/passwd
Collect groups:
cat /etc/group
Collect privileged users:
cat /etc/sudoers
Check sudo configuration:
ls -la /etc/sudoers.d/
Find UID 0 users:
awk -F: '$3==0 {print $1}' /etc/passwd
Why:
Detect unauthorized accounts
Detect privilege escalation
️⃣ Step 1: Collect Volatile Evidence
🔥 Most Important First
🧠 Memory Evidence (RAM)
Why Memory First:
RAM contains temporary information
Lost after reboot
Contains:
Running malware
Encryption keys
Passwords
Active connections
Command history
Memory Collection Tools
🛠 LiME
Linux Memory Extractor
Install:
yum install lime-forensics
Collect memory:
insmod lime.ko "path=/evidence/case001/01_memory/memory.lime format=lime"
Alternative:
AVML
Azure Virtual Machine Memory Dump Tool
Analyze Memory
Tool:
Volatility Framework
Install:
pip install volatility3
Analyze:
vol.py -f memory.lime linux.pslist
Useful commands:
Process listing:
linux.pslist
Network connections:
linux.netstat
Loaded modules:
linux.lsmod
️⃣ Step 2: Running Process Collection
🎯 Purpose
Identify malicious processes
Detect unauthorized software
Collect processes
Command:
ps aux
Save evidence:
ps aux > /evidence/case001/02_processes/processes.txt
Detailed process view:
ps -ef
Process tree:
pstree -p
Identify high CPU:
top
Identify suspicious processes:
ps aux --sort=-%cpu
Check process executable:
ls -l /proc/PID/exe
Example:
ls -l /proc/1234/exe
️⃣ Step 3: Network Evidence Collection
🎯 Purpose
Identify attacker communication
Find command and control servers
Active Connections
Command:
ss -tunap
Meaning:
s
socket information
t
TCP
u
UDP
n
show IP numbers
a
all connections
p
show process
Save output:
ss -tunap > /evidence/case001/03_network/network.txt
Open Ports
Command:
netstat -tulpn
Modern replacement:
ss -tulpn
Routing Information
Command:
ip route
Network Interfaces
Command:
ip addr
DNS Information
Command:
cat /etc/resolv.conf
ARP Cache
Command:
arp -a
️⃣ Step 4: User Activity Evidence
Login History
Command:
last
Shows:
User login
Time
Source IP
Failed Login Attempts
RHEL/CentOS:
cat /var/log/secure
Ubuntu:
cat /var/log/auth.log
Current Logged Users
Command:
who
Command History
Collect:
cat ~/.bash_history
Root history:
cat /root/.bash_history
SSH Authentication Evidence
Location:
/var/log/secure
Ubuntu:
/var/log/auth.log
Search failed SSH:
grep "Failed password" /var/log/secure
️⃣ Step 5: Log Evidence Collection
📂 Linux Log Locations
RHEL Based:
/var/log/messages
/var/log/secure
/var/log/audit
Ubuntu Based:
/var/log/syslog
/var/log/auth.log
/var/log/kern.log
System Logs
Collect:
cp -a /var/log/* /evidence/case001/04_logs/
Journal Logs
systemd logs:
journalctl
Export:
journalctl > /evidence/case001/04_logs/journal.log
Authentication Logs
Export:
journalctl _SYSTEMD_UNIT=sshd.service
️⃣ Step 6: File System Evidence
🎯 Purpose
Detect malware files
Detect modified files
Find Recently Modified Files
Last 24 hours:
find / -mtime -1
Last 7 days:
find / -mtime -7
Suspicious Locations
Check:
/tmp
/var/tmp
/dev/shm
/etc/cron*
Collect Cron Jobs
User cron:
crontab -l
System cron:
ls -la /etc/cron*
Startup Services
Command:
systemctl list-unit-files
️⃣ Step 7: File Integrity Evidence
Hash Collection
Purpose:
Prove file has not changed
Tool:
sha256sum
Example:
sha256sum suspicious_file
Save:
sha256sum file > hashes.txt
Enterprise Tools
AIDE
Advanced Intrusion Detection Environment
OSSEC
Host Intrusion Detection System
️⃣ Step 8: Audit Evidence
Linux Audit Framework
Service:
auditd
Status:
systemctl status auditd
Logs:
/var/log/audit/audit.log
Search Commands
User actions:
ausearch -ua username
File changes:
ausearch -f /etc/passwd
️⃣ Step 9: Evidence Integrity
🔐 Hash Evidence
Generate hash:
sha256sum evidence_file
Example:
sha256sum memory.lime
Output:
abc123456789 memory.lime
Purpose:
Prove evidence was not modified
️⃣ Step 10: Chain of Custody
📄 Evidence Documentation
Record:
Case ID
Investigator Name
Date
Time
System Name
Evidence Type
Hash Value
Storage Location
Example:
Case:
INC-2026-001
Evidence:
Server01 Memory Dump
Hash:
SHA256 value
️⃣ Enterprise Incident Response Tools
🛠 Collection Tools
Velociraptor
GRR Rapid Response
Osquery
Wazuh Agent
Elastic Agent
🛠 Analysis Tools
Volatility
Autopsy
Timesketch
Splunk
Elastic SIEM
️⃣ Final Evidence Collection Workflow
1️⃣ Identify affected Linux server
2️⃣ Record date and time
3️⃣ Collect memory
4️⃣ Collect running processes
5️⃣ Collect network connections
6️⃣ Collect user activity
7️⃣ Collect authentication logs
8️⃣ Collect filesystem information
9️⃣ Generate hashes
🔟 Document chain of custody
✅ Transfer evidence to forensic storage