Linux Investigation Orientation: Summary and Scope

What this module established

There is no central registry, and the kernel is readable instead. 773 configuration files across 151 directories in five formats, against 53 entries describing one process. The same design decision produces both, and an investigator loses one thing and gains the other.

The richest evidence expires first. Five process readings exist while a process does and vanish together the moment it exits. An intrusion's first four stages took two minutes, the investigation arrived eleven days later, and what it could still reach was decided by when somebody noticed.

Decay and retention are separate questions. One source of nine was moving on a measured host and eight were static. A rotated log does not decay at all, and its window slides forward until your incident date falls off the end, which no single ranking can express.

Kernel files report a size they do not have. Five paths reporting zero bytes held 4,775 between them, so a collection that skips empty files loses everything the kernel answers and reports success.

Six log sources use six timestamp conventions. Two omit the year, so a line reading Dec 30 parsed on 4 January lands eleven months in the future. Ordering plus one dated anchor resolves it without assuming anything.

Persistence is a coverage problem, not a search. Thirteen of twenty-three mechanisms existed on a measured host, and six of them each restart something independently, so removing the one you found leaves five working.

Collection costs 13.64 milliseconds and cannot be repeated. Every expensive phase of an investigation can be run again tomorrow and the free one cannot, which is what decides the order.

Nine modules derived nine different ordering principles. Two of them contradict each other directly, none transfers, and only the question they all answer does.

The lab needs one virtual machine and an account that can become root. Eight of ten modules run on it. Measured unprivileged, every kernel table reads and 0 of 30 descriptor lists do.

What this course will not settle

A course is defined as much by its boundaries as by its content, and four questions belong to somebody else.

Memory analysis. This course teaches the decision to acquire, what the image is, and the handoff. What is inside it is a discipline with its own tooling and failure modes, and LX9 stops at the manifest deliberately.

Malware analysis. Establishing that a binary is worth examining is here; examining it is not. The course recovers a file from a descriptor and hands it on rather than opening it.

Detection engineering. Everything here is retrospective. Writing a rule that fires next time is a different discipline from reading what happened last time, and the two are often confused because both involve logs.

Governance and reporting beyond the handover. LX9.9 takes a collection to the point where somebody else can work it. What an organization then does about it, and what it has to report to whom, is a separate subject.

What to carry into module one

Ask what the kernel already knows before asking what a tool can tell you. It is usually more and always closer to the source.

Measure the host rather than reciting a list. Decay, retention, persistence mechanisms and collection cost all differ between machines that look identical.

Claim the reading rather than the host. What the process table contained when this command ran survives questioning; what the host had at a time does not.

Write down what is absent. A source the estate never enabled, a window that has expired, and a mechanism that does not exist are all findings rather than gaps.

Build the lab before starting. One machine, one snapshot, three baselines, and an account that can become root.

Starting module one

Module one opens on what a running process actually exposes: the descriptor list, the command line, the binary path and the identity, and the file that has no name left. Every reading in it works on the machine you have just built.

The orientation is finished. Everything after this is a technique you can run.