@@ -8,7 +8,7 @@ and feel free to ask questions as you go. Remember to document your answers and
88# Chapter 1. Linux Directories
99
1010<a href =" Subjects/1. Linux Directories/index.html " target =" _blank " >Linux Directory Structure By https://dev.to/softwaresennin </a ><br >
11- <a href =" Resources/PomeranzLinuxForensics.pdf#page=15 " target =" _blank " >PomeranzLinuxForensics page 15-20</a >
11+ <a href =" Resources/PomeranzLinuxForensics.pdf#page=15 " target =" _blank " >PomeranzLinuxForensics page 15-20 By Hal Pomeranz </a >
1212
1313
1414## Questions
@@ -19,9 +19,14 @@ and feel free to ask questions as you go. Remember to document your answers and
19195 . what is special about the /tmp directory, why as forensic analysts we would want to check it?
2020
2121# Chapter 2. Linux Logs
22- - Logs.md in Subjects/2.Linux Logs/Logs.md
23- - Linux Audit Subsystem by IzyKnows Part 1-3 in Subjects/2.Linux Logs/*
24- - Laurel resources(LAUREL_README.md, laurel.8.md, laurel-about.7.md)
22+ <a href =" Subjects/2. Linux Logs/Logs.md " target =" _blank " >Linux Logs guide</a ><br >
23+ <a href =" Subjects/2. Linux Logs/Linux_Auditd_For_ThreatDetection_IzyKnows_Part1.pdf " target =" _blank " >Linux Audit Subsystem Part 1 By IzyKnows</a ><br >
24+ <a href =" Subjects/2. Linux Logs/Linux_Auditd_For_ThreatDetection_IzyKnows_Part2.pdf " target =" _blank " >Linux Audit Subsystem Part 2 By IzyKnows</a ><br >
25+ <a href =" Subjects/2. Linux Logs/Linux_Auditd_For_ThreatDetection_IzyKnows_Part3.pdf " target =" _blank " >Linux Audit Subsystem Part 3 By IzyKnows</a ><br >
26+ <a href =" Subjects/2. Linux Logs/LAUREL_README.md " target =" _blank " >LAUREL_README By https://github.com/threathunters-io/laurel </a ><br >
27+ <a href =" Subjects/2. Linux Logs/laurel-about.7.md " target =" _blank " >laurel-about.7.md By https://github.com/threathunters-io/laurel </a ><br >
28+ <a href =" Subjects/2. Linux Logs/laurel.8.md " target =" _blank " >laurel.8.md By https://github.com/threathunters-io/laurel </a ><br >
29+
2530
2631## Questions
27321 . Explain the difference between utmp, wtmp, btmp and lastlog files.
@@ -38,10 +43,11 @@ and feel free to ask questions as you go. Remember to document your answers and
3843 and how would you detect such tampering? Give atleast 3 tamper techniques and 2 security techniques.
3944
4045# Chapter 3. Linux FileSystems
41- - procfs - _ proc.html in Subjects/3.Linux FileSystems/_ proc.html
42- - inodes - What_Are_inodes_linux.pdf in Subjects/3.Linux FileSystems/What_Are_inodes_linux.pdf
43- - XFS - XFS Filesystem in PomeranzLinuxForensics.pdf (page 169-181)
44- - XFS Archeology - PomeranzLinuxForensics.pdf Page 182 + LinuxForensicsLab VM
46+ <a href =" Subjects/3. Linux FileSystems/_proc.html " target =" _blank " >procfs</a ><br >
47+ <a href =" Subjects/3. Linux FileSystems/What_Are_inodes_linux.pdf " target =" _blank " >inodes</a ><br >
48+ <a href =" Resources/PomeranzLinuxForensics.pdf#page=169 " target =" _blank " >PomeranzLinuxForensics page 169-181 By Hal Pomeranz</a ><br >
49+ <a href =" Resources/PomeranzLinuxForensics.pdf#page=182 " target =" _blank " >PomeranzLinuxForensics page 182+LinuxForensicsLab VM By Hal Pomeranz</a >
50+
4551
4652## Questions
47531 . Explain how the /proc filesystem differs from other filesystems in Linux.
@@ -63,8 +69,9 @@ and feel free to ask questions as you go. Remember to document your answers and
6369
6470
6571# Chapter 4. Linux Attacks Techniques
66- - Read Persistence mechanism in Subjects/4.Linux Attacks Techniques/Persistence.html
67- - Go through linux-persistence-map.pdf
72+ <a href =" Subjects/4. Linux Attacks Techniques/Persistence.html " target =" _blank " >Persistence mechanisms</a ><br >
73+ <a href =" Subjects/4. Linux Attacks Techniques/linux-persistence-map.pdf " target =" _blank " >Linux Persistence Map</a >
74+
6875
6976## Questions
70771 . What is a persistence mechanism, and why is it valuable to attackers?
@@ -75,9 +82,9 @@ and feel free to ask questions as you go. Remember to document your answers and
7582
7683
7784# Chapter 5. Linux Artifacts & Live Response
78- - Artifacts.md in Subjects/2. Linux Artifacts & Live Response/Artifacts.md
79- - PomeranzLinuxForensics.pdf pages 5-13(with Exercise 1)
80- - PomeranzLinuxForensics.pdf Exercise 2-4(Honeypot Lab)
85+ < a href = " Subjects/5. Linux Artifacts & Live Response/Artifacts.md " target = " _blank " >Linux Artifacts guide</ a >< br >
86+ < a href = " Resources/ PomeranzLinuxForensics.pdf#page=5 " target = " _blank " >PomeranzLinuxForensics page 5-13(including Exercise) By Hal Pomeranz</ a >< br >
87+ < a href = " Resources/ PomeranzLinuxForensics.pdf" target = " _blank " >PomeranzLinuxForensics Exercise 2-4(Honeypot Lab) By Hal Pomeranz</ a >
8188
8289
8390## Questions
0 commit comments