Unit 1: The shell and the filesystem · Lesson 4 of 5 · 18 min
Opening a case folder
Create folders, copy evidence without changing it, rename and clean up safely.
mission
- You are
- You are starting an investigation file for web01, case 0142.
- Situation
- Before you analyse anything, you copy the logs into a case folder so the originals stay untouched.
- Goal
- Build a case folder and copy auth.log into it with its original timestamp.
- Hand in
- ~/case-0142/evidence/auth.log with the same date as the original.
Preserving evidence
- Original/var/log/auth.log
- cp -pKeeps the date and mode
- Evidence folder~/case-0142/evidence
- Hashsha256sum proves it never changed
Create the folders in one go
mkdir -p creates every missing level and does not complain if a folder already exists.
mkdir -p ~/case-0142/evidence ~/case-0142/notes
Copy evidence the right way
A plain copy gets today's date and your group. cp -p preserves the timestamp and group, which is what an investigator needs.
cp -p /var/log/auth.log ~/case-0142/evidence/ cp /var/log/auth.log ~/case-0142/evidence/auth-nop.log ls -l ~/case-0142/evidence total 112 -rw-r----- 1 learner learner 57241 Oct 22 11:43 auth-nop.log -rw-r----- 1 learner adm 57241 Oct 14 23:59 auth.log
you should see Same size, different dates. The plain copy shows the moment you ran it, so yours will differ.
defender tip Timestamps are evidence. Copy with -p, and never edit the original.
cp and cp -p
-rw-r----- learner learner Oct 22 11:43 auth-nop.log
New date, your group
-rw-r----- learner adm Oct 14 23:59 auth.log
Original date and group kept
Rename, then clean up
mv renames or moves. rm deletes with no undo, so remove only what you just created and name it exactly.
echo "web01 handover started" > notes/log.txt mv notes/log.txt notes/timeline.txt ls notes timeline.txt rm evidence/auth-nop.log tree ~/case-0142 /home/learner/case-0142 ├── evidence │ └── auth.log └── notes └── timeline.txt 3 directories, 2 files
Match several files with a wildcard
* matches any characters. The shell expands it before the command runs, so check what it matches with ls first.
ls /var/log/auth.log* /var/log/auth.log /var/log/auth.log.1 ls /srv/inventory/servers/*01.txt /srv/inventory/servers/backup01.txt /srv/inventory/servers/db01.txt /srv/inventory/servers/web01.txt
you should see Yesterday's log, auth.log.1, exists too. You will need it later.
defender tip Before any rm with a wildcard, run the same pattern with ls and read the list.
| Command | What it does |
|---|---|
mkdir -p a/b | Create folders, parents included |
cp -p src dst | Copy and keep the timestamp |
mv old new | Rename or move |
rm file | Delete a file. No undo |
rm -r dir | Delete a folder and everything in it |
What a defender takes away
- 1Work on copies, never on originals.
- 2cp -p keeps the dates investigators rely on.
- 3Preview every wildcard with ls before rm.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.