Linux and Mac Forensics

These flashcards cover key vocabulary related to Linux and Mac forensics from the lecture notes.

Volatile Data

Data that is lost when a machine is powered off.

Non-Volatile Data

Data that remains intact even when a device is turned off.

Linux Operating System

An open-source operating system widely used for both servers and desktops.

Memory Forensics

The process of analyzing the data stored in memory (RAM) to uncover evidence.

Volatility

A Python framework utilized for memory forensics.

Sleuth Kit

A collection of command-line tools for analyzing file system images.

Cat Command

A Unix command used to display the content of files or concatenate files and print on the standard output.

Ifconfig Command

A command used to configure and display network interface parameters in Unix-based systems.

IP Address

A unique address assigned to each device connected to a network.

Promiscuous Mode

A network interface mode that allows a device to intercept and read all network packets.

Netstat Command

A command that displays network connections, routing tables, and network interface statistics.

Routing Table

A data table that contains the routes to specific network destinations.

Photorec

An open-source data recovery software that can recover lost files including documents from storage.

File System Image

A file that contains the complete contents and structure of a file system.

Files and Directories

API used for storing and organizing data in a file system.

Kernel

The core component of an operating system that manages system resources and communication between hardware and software.

MacOS Forensics

The process of investigating and analyzing Mac operating systems for evidence.

Spotlight

A search utility in MacOS that indexes and retrieves files and folders quickly.

Bash

A Unix shell and command language used in Linux and MacOS for command line interface.

Time Machine

The built-in backup feature of MacOS that allows for restoring system and user files.

Authentication Logs

Logs that record login attempts and access events to track user activity and security breaches.