~/giac-glir · Linux File System Artifacts ▊
← GIAC Linux Incident Responder
GIAC · objective · 8% of the exam
Linux File System Artifacts — GIAC Linux Incident Responder
The official GIAC documentation our Linux File System Artifacts practice questions are cited to. Review the primary sources, then practise.
Official references for this objective
-
Sans — FOR577: LINUX Incident Response and Threat Hunting | SANS Institute
how their superblock and inode structures, timestamps, and metadata can be interpreted with The Sleuth Kit or, where necessary, recovered by hand to reconstruct what