Evidence on a Linux system is scattered across dozens of predictable locations. This article is a map. The power of a directory listing is that you know what should be there — anything that doesn't belong is your lead.
| Artifact | Forensic value |
|---|---|
| .bash_history | Commands executed — the closest thing to a user's timeline |
| .ssh/authorized_keys, known_hosts | Backdoor keys; hosts they've connected to |
| ~/.local/share/recently-used.xbel | Recently opened documents |
| Browser profiles | History, downloads, cookies, saved passwords (SQLite/LevelDB) |
| .thumbnails / .cache/thumbnails | Preview images of files that may be deleted |
| ~/.Trash | Files "deleted" via file managers |
| Editor backups & swap | vim .swp files, nano .save, old content |
| Mail / chat clients | Conversations, contacts |
# in order with timestamps (HISTTIMEFORMAT only affects future entries)
cat /home/bob/.bash_history
# other shells keep their own
cat /home/bob/.zsh_history # zsh, with timestamps by default
cat /home/bob/.ash_history # busybox/ash
# deleted history may be recoverable from RAM
# (see linux.bash plugin in the Volatility guide)HISTSIZE lines are kept.
A killed shell or a cleared history destroys it. Always collect memory too if history matters.
Config files record intent: what the administrator set up and when.
/etc/passwd, /etc/shadow, /etc/group — accounts, hashes, memberships./etc/sudoers + /etc/sudoers.d/ — who can escalate./etc/crontab, /etc/cron.d/, /var/spool/cron/ — scheduled tasks (favorite persistence)./etc/rc.local, /etc/systemd/system/ — autostart mechanisms./etc/hosts, /etc/resolv.conf — network tampering (DNS redirection)./etc/ssh/sshd_config — SSH hardening or backdoor settings./etc/apt/sources.list* or DNF/zypper configs — malicious repos./etc/pam.d/ — authentication tampering.# units not tied to an installed package are suspicious
ls -la /etc/systemd/system/
systemctl list-unit-files --type=service --state=enabled/var/log — see the log analysis article./var/spool/cron — per-user cron jobs./var/tmp, /tmp, /dev/shm — writable dirs, classic staging grounds for attackers./var/lib/docker/ — container filesystems and image layers./var/www — web roots; webshells live here./var/lib/mysql — raw database files (can hold logs too).# common webshell signatures
grep -rEl "eval\(|base64_decode|system\(|passthru|shell_exec" /evidence/var/www --include="*.php"
find /evidence/var/www -name "*.php" -newermt "2026-08-10" | head/var/log/dpkg.log, /var/log/apt/, dnf/yum history. Correlate installs with incident timing.~/.ssh/ plus authorized_keys timestamps tell you when a backdoor was installed.sqlite3.docker ps -a on a live box, or image layers on disk, show what ran./tmp or ~/.screen/ can contain live terminal state.Attackers who gain a foothold want it to survive reboots. The checklist above is the persistence checklist: cron, systemd units, rc.local, ssh keys, PAM, package repos. Also watch for anti-forensics:
.bash_history or a tampered /var/log (deleted/zeroed logs).touch -r or touch -d to mask activity.sshd, updates)./proc/*/fd on a live box).A sensible priority for a first pass:
/home/*/.* dotfiles (history, ssh, trash, thumbnails).authorized_keys files across all users and root.find / -newermt "date" -type f on the mounted image.For the tools to pull these artifacts off an image, see The Sleuth Kit guide.