Overview
Linux disk and memory forensics lab with Volatility and Sleuthkit. Hands-on investigation of disk artifacts, memory dumps, and log analysis with proper chain of custody and evidence integrity procedures aligned to Kenya Cybercrime Act.
Environment & Scope
Lab Setup
Ubuntu 20.04 LTS (target) | Kali Linux (analysis) | Volatility 3.0+ | Sleuthkit 4.0+ | 8GB RAM recommended
Scope
- • Disk forensics: - File recovery (deleted files, carving) - Filesystem analysis (timeline reconstruction) - User activity tracking • Memory forensics: - Process analysis - Network connections - Malware detection (signature & behavioral) • Log analysis: - Bash history, syslog, auth logs - Application logs • Chain of custody and evidence integrity • Report generation for legal proceedings
Methodology
- 1. Evidence acquisition (dd, dcfldd with hash verification) 2. Disk analysis: - Filesystem mounting - Deleted file recovery - Timeline creation (mactime) - User artifact analysis 3. Memory analysis: - Dump acquisition (dd from /dev/mem) - Process enumeration - Network connection analysis - String/code extraction 4. Cross-correlation (disk ↔ memory findings) 5. Evidence reporting with legal formatting
Key Findings
• Attacker persistence: cron job at /var/spool/cron/crontabs/root executing reverse shell • Timeline: first access 2026-10-01 14:32 UTC, persistence installed 15:47 UTC • Memory artifacts: Python HTTP server listening on port 8888 • Deleted files: 12 malware samples in /tmp • Affected assets: Apache server, PostgreSQL database, SSH private key
Business Impact
Without forensic investigation, attackers leave evidence undetected, enabling continued compromise. This lab demonstrates proper evidence collection for legal proceedings and incident response.
Remediation & Improvements
- • Incident response: terminate affected processes, isolate system • Forensic findings: 23-page report suitable for law enforcement (KOC Act compliant) • Eradication: kernel patch, malware removal, credential rotation
Lessons Learned
- 1. Chain of custody is non-negotiable — evidence must be legal-ready 2. Memory analysis reveals what disk doesn't (active malware, network callbacks) 3. Timeline reconstruction is detective work — correlate multiple sources
Technologies
Tools & Platforms: Volatility | Sleuthkit | autopsy | strings | hexdump | tcpdump
Hiring Relevance: Digital Forensics Analyst, Incident Response Team, Law Enforcement Analyst
View on GitHub
Full implementation, README, and deployment instructions available at:
GitHub Repository →