Essential Linux Commands for Log Analysis

Prepare Sample SSH Log Files

Log download  the log files contain relevant SSH events, including timestamps, source IP addresses, usernames, actions (login, logout), etc.

Commands for Hashing Log Files

1. Generating a Hash (SHA-256)

The most common and secure standard for forensic imaging and log analysis is SHA-256.

• Command: sha256sum ssh.log

  

• Explanation: This command calculates the SHA-256 hash of the file ssh.log. It will output a 64-character hexadecimal string followed by the filename.

2. Saving the Hash to a Verification File

In a forensic investigation, you must save the hash immediately after collecting the evidence.

• Command: sha256sum ssh.log > ssh.log.sha256

  

• Explanation: The > operator redirects the output into a new file named ssh.log.sha256. This file acts as your "Evidence Reference".

3. Verifying the Integrity

To check if the log file has been tampered with or corrupted later:

• Command: sha256sum -c ssh.log.sha256

• Explanation: The -c (check) flag tells the system to read the hash from the .sha256 file and compare it with the current state of ssh.log.

  • Result OK: The file is identical to the original.

    

  • Result FAILED: The file has been modified or corrupted.

Essential Linux Commands for Log Analysis

1. grep (Global Regular Expression Print)

Used to search for specific text patterns within the log file.

• Command: grep "success" ssh.log

• Purpose: To filter and display only the lines where a login was successful.

• Command: grep "failure" ssh.log | wc -l

• Purpose: To count the total number of failed login attempts.

  

Steps to Analyze SSH Log Files

#cat Desktop/Web_Server_Logs/ssh.log 

Analyze failed login attempts:

 #cat Desktop/Web_Server_Logs/ssh.log | grep failure 

Investigate SSH sessions from unusual or suspicious source IP addresses: 

awk (Pattern Scanning and Processing)

Used to extract specific columns (fields) from the log.

• Command: awk '{print $3}' ssh.log

• Purpose: To extract the Source IP address (which is in the 3rd column)

  
  
  

• Command: awk '{print $5}' ssh.log

• Purpose: To extract the Destination IP address (which is in the 5th column).

  
  
  

If you want to find the Top 10 IP addresses trying to hack your server, use this combined

Step-by-step breakdown:

1. awk '{print $3}': Get all Source IPs.

2. sort: Group identical IPs together.

3. uniq -c: Count how many attempts each IP made.

4. sort -nr: Sort numerically in reverse (highest count at the top).

5. head -n 10: Show only the top 10 results.

#awk '{print $3}' Desktop/Web_Server_Logs/ssh.log | sort | uniq -c | sort -nr | head -n 10

Top Target (Destination) IPs:

• 192.168.28.254 (High frequency of attempts)

  
  
  

• 192.168.23.203 (High frequency of attempts)

• 
  
  

• 192.168.27.203 (High frequency of attempts)

• 

1. 1331904022.010000
   → Unix Timestamp (เวลาที่เกิดเหตุการณ์)

2. CU46Bb2UypzdF4eTW
   → Session ID / Connection ID ของ SSH

3. 192.168.202.110
   → Source IP (เครื่องที่พยายามเชื่อมต่อ)

4. 36586
   → Source Port

5. 192.168.27.203
   → Destination IP (เครื่องปลายทาง = SSH Server)

6. 22
   → Destination Port (SSH)

7. undetermined / failure
   → สถานะการเชื่อมต่อ

• undetermined = ยังไม่ทราบผล (handshake)

• failure = login ล้มเหลว

8. INBOUND
   → เป็นการเชื่อมต่อขาเข้า (incoming connection)

9. SSH-2.0-OpenSSH_5.8p1 Debian-ubuntu3
   → Banner ของ SSH 

• The SSH log indicates repeated inbound connection attempts from IP address 192.168.202.110 targeting the SSH service on 192.168.27.203 over port 22.
  Multiple sessions resulted in authentication failures, which is consistent with a brute-force or unauthorized login attempt.

 Time Conversion Command

Since the log uses Unix Epoch Time, you can convert it to a human-readable format using the date command.

• Command: date -d @1332017793.040000 

• Purpose: Converts the timestamp 1332017793.040000  into a standard Date/Time format.

อ่านเพิ่มเติม:

การจัดเก็บ Log file ให้ถูกกฎหมายด้วย 5 เครื่องมือ ใช้งานฟรีๆ

FortiGate Sample logs

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น ช่วยเตือนความจำ

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud

DIGITAL FORENSICS:PicoCTF Writeups: extensions

PicoCTF Writeups: extensions

Challenge Overview

• Event: PicoCTF 2019
• Challenge Name: Extensions
• Category: Forensics

This is a really weird text file. Can you find the flag?

Get the flag from TXT.

Step 1: Understanding File Extensions and Magic Numbers

Operating systems don’t rely only on a file’s extension (like .txt or .png) to identify its type. Instead, they check the:

1.What is a Magic Number?

A Magic Number (or File Signature) is a specific set of bytes at the very beginning of a file that identifies its actual format. Unlike file extensions (like .txt or .jpg), which are easily changed by a user, Magic Numbers are required by software to correctly interpret and render the file data.

 

Solution

 

I started by downloading the provided file, flag.txt, onto my Windows  virtual machine. Opening it in Notepad revealed this:

Inspecting the Internal Structure

When opening flag.txt with Notepad, the data appears unreadable, but the first few characters are key:

• Appears as: ‰PNG

2. Evidence of File Obfuscation

In your provided images, there is a clear mismatch between the file's name and its internal structure:

• Deceptive Name: The file is named flag.txt, making it look like a simple text document.

• Header Signature (ASCII): When opened in Notepad, the first few characters are ‰PNG  . This is the standard header for a PNG image.

• Hexadecimal Signature: In the hex view (likely from FTK Imager), the first four bytes are 89 50 4E 47. This is the unique hexadecimal signature that every PNG file must start with.

Verification and Tools

• Linux file Command: When run against this file, the command returns PNG image data. This tool works by reading the Magic Number rather than trusting the .txt extension.

Checking the file with file.

It's a PNG picture file, not a text file.

When checking this file in a Linux system (such as Kali) using the file command, the result

It's a PNG picture file, not a text file.

4. Conclusion

The file flag.txt is not a text file; it is a PNG image. To view the content correctly as an image, you can simply rename the file back to flag.png. Changing a file’s extension doesn’t modify its content—it just helps the operating system interpret the file correctly.

 Opening the file

After renaming the file, I opened it as a PNG image:

File Magic Numbers 

Magic numbers are the first bits of a file which uniquely identify the type of file.

photo credit:  gist.github.com

Why is the Magic Number Important in Forensics?

During an investigation, suspects often change file extensions to hide evidence (e.g., renaming an incriminating image from .jpg to .dll or .txt).

• Antivirus/Forensic Tools: These tools perform a "Signature Mismatch" analysis to detect files that are attempting to hide their true identity.

• Data Recovery: If the file system structure is damaged and the extensions are lost, recovery software uses these Magic Numbers to identify and reconstruct the original file types.

Summary from the example: Your file is a PNG image that has been renamed with a .txt extension. If you change the extension back to .png, you will be able to view the image normally.

Ref:PocoCTF

อ่านเพิ่มเติม:

• INE Lab 3 สอบ (ECDFP)

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น ช่วยเตือนความจำ

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud

Practical Windows Forensics

Windows forensics is a cornerstone of modern cybersecurity, giving analysts the power to uncover what happened during a security incident and how. A practical approach focuses on real-world investigation techniques—collecting evidence, interpreting artifacts, and building a reliable timeline of events that reveals attacker behavior and system activity.

At its core, Windows forensics revolves around examining the OS’s vast ecosystem of digital traces. These include registry entries , event logs , browser artifacts , memory captures , Prefetch files , and file system records such as the MFT . Each artifact acts like a clue, helping investigators map program execution, persistence mechanisms, user actions, network connections , and potential malicious activity. Proper evidence collection ensures everything remains intact, verifiable, and legally defensible.

A solid forensic workflow typically begins with volatile data—RAM analysis , active processes, network sessions—and then moves into disk-based artifacts. By correlating these diverse sources, analysts can reconstruct the attacker’s path: how they got in, what they did, and whether they attempted lateral movement or data exfiltration . Shadow copies, jump lists, event logs, and timeline construction tools all play critical roles in building a complete picture.

Modern Windows environments also integrate cloud services , endpoint detection telemetry , and advanced logging. Practical forensics blends these external sources with traditional disk analysis to achieve a deeper, more accurate understanding of incidents—especially in complex scenarios like ransomware attacks, insider threats, and APT activity.

In the end, Practical Windows Forensics is about more than just tools—it’s about mindset, methodology, and analytical discipline. With the right workflow and attention to detail, analysts can uncover the truth behind any incident and help strengthen organizational defenses.

Practical Windows Forensics: Cheat Sheet

MACB Timestamps

Volatility

• Practical Windows Forensics Cheat Sheet: A step-by-step guide covering key artifacts and analysis techniques.
  Practical Windows Forensics Cheat Sheet on GitHub

Practical Windows Forensics Download

ที่มา :bluecapesecurity.com

อ่านเพิ่มเติม:

• Windows Forensics with Belkasoft
• WINDOWS FORENSICS WORKSHOP CASE
• PENTESTERACADEMY WINDOWS FORENSICS
• Windows Security & Forensics Free Online Training by Erdal Ozkaya
• 13CUBED INTRODUCTION TO WINDOWS FORENSICS
• Windows Forensics

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น ช่วยเตือนความจำ

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud