Linux Endpoint Investigation

The discipline, the estate, the evidence landscape, and what this course will and will not settle. Ten sections measured on real hosts, ending with a lab you can build in an hour.

The model a Linux investigator holds before any technique makes sense: the filesystem as retention, the inode and its four times, authority as a number, the process and the kernel interface, memory against disk, names and deletion, and the sequence that puts all ten readings in the order that preserves what expires first.

Applied filesystem investigation on the two filesystems that dominate Linux estates. Reading structures below what stat reports, separating a written timestamp from an earned one, recovering what a deletion left, building a volume into a sequence, and the journal that holds the one previous state nothing else on the volume keeps.

Eight log sources on one host, read for what each can and cannot establish. The architecture that decides what was recorded at all, the field classes that separate a machine-written value from a program's own words, the source that observes rather than listens, and the correlation that turns a request, a process and a file into one event.

Establishing and dating the entry point, by SSH or by the web application. The field that says which door was used before either is investigated, the census that scopes a credential across an estate, the sweep that finds what a compromise dropped without assuming where, and the process signature that identifies a channel leaving no file at all.

The escalation chain reconstructed from what it left rather than from what the exploit claims. Six routes from a foothold to root, graded by the evidence each leaves rather than catalogued by mechanism; the baseline that decides whether a sweep result is a finding; the process relationship that orders an escalation on a host whose clock you do not trust; and what holding root does to every other source in the investigation.

Every foothold on the host found rather than the first one. A Linux host executes something it was not executing a moment ago at five moments and no more, which bounds the kinds of mechanism without bounding the search; a stock host carries 165 attachment points and 133 of them verify mechanically.

The trust graph read rather than reconstructed. On a Linux estate the edges are written down in advance: a key file is a list of who may connect, somebody authored every line, and the whole picture of who reaches what exists as configuration before any incident. Ten sections collect that graph, establish which edges were used, cover the pivots the key files cannot contain, and cost the containment options. The compromised host answers almost none of it.

A container is a process with a restricted view, and almost everything about it is readable from the node without entering anything. Ten sections read namespaces, writable layers, cgroups, processes, connections and boundaries from the kernel's own records, establish what survives when a container stops, and end with an ordering principle: every durable artifact here is reached through a volatile one.

A defensible collection from a host that cannot be taken down, in the right order. Ten sections measure what a live reading actually claims, what collecting costs the host, and the order that follows, ending with the one principle in this course that is about the investigator rather than the evidence.

What only memory holds, how to acquire it without destroying it, and how to characterize a binary without running it. Ten sections measured on real hosts, ending with the tenth ordering principle.

What exists before an incident and what survives after it. Ten sections measured against this course's own material, ending with the eleventh ordering principle.

Ten sheets of Linux investigation commands, each entry showing what the output proves, what it does not, and where the course teaches the reasoning behind it.

Seven end-to-end Linux investigation procedures, each with the commands, the branch points, and what the procedure does not cover.

Building a Linux investigation lab on hardware you already own, with the logging Linux ships disabled turned on, and a written ground truth to check your analysis against.

Seven worked Linux investigations, each carried from the referral to a written finding, including the ones that end in a defensible no.

Seven Linux threats, each with the examination sequence that establishes what happened, the check that could end it early, and what the handoff must carry.

Where to practice Linux investigation and use it at work: guided scenarios against Linux evidence, the toolkit, the detection library, and your own lab.

Linux forensic tool documentation, distribution and kernel references, container and cloud provider resources, and incident response frameworks used throughout the Linux Endpoint Investigation course.

Linux Endpoint Investigation end-of-course exam: a simulation-based assessment testing your ability to triage, investigate, and report on a Linux server compromise you have not seen before, using the artifacts and the method built across the course.