Forensics of Linux Directory and Active Processes
Key Discovery Report
Situation:
The objective was to locate and identify two sensitive keys (KEY001 and KEY002) within a Kali Linux virtual machine using Linux command-line tools. The project required navigating the filesystem, inspecting active processes, and applying pattern-matching techniques.
Obstacles:
- Permission Restrictions: Certain directories and files were inaccessible due to insufficient privileges.
- Command Misuse: Initial attempts with specific flags (e.g.,
ps -fC KEY
) failed due to overly restrictive search parameters. - Complex Search Scope: Locating the keys required an efficient search strategy across a large filesystem and process list.
Actions Taken:
- Used the
find
command withsudo
to search for files in the filesystem with names starting with "KEY*". - Utilized the
ps -ef
command paired withawk
to identify processes containing "KEY" in their output. - Debugged failed commands by adjusting parameters and using broader search techniques to ensure accurate matches.
Results:
- KEY001 was successfully located using the
find
command and identified asKEY001-t8DnV+HDpVm9Ey0Y2nUfxA=
. - KEY002 was identified through process inspection with
ps
andawk
, yieldingKEY002-kmrMSsSaaSvbbVz3yW0zaw=
. - Demonstrated effective command-line and forensic analysis skills by overcoming technical challenges and achieving project objectives.
Tool Purpose Overview
Kali Linux:
- A specialized Linux distribution for penetration testing and cybersecurity tasks, providing the necessary environment for forensic investigations.
find:
- Used to search files and directories based on specific criteria such as name patterns (
-name "KEY*"
).
ps:
- Inspects currently running processes, offering insights into active system operations.
awk:
- A text-processing tool that filters and extracts specific patterns from command output, enabling precise identification.
sudo:
- Provides elevated privileges to access restricted files and directories, ensuring comprehensive search capabilities.
General Command-Line Skills:
- Enabled efficient navigation, debugging, and execution of commands within the Linux environment.
View PDF Document