What are your goto Linux memory dump tools for forensics?
/dev/mem access is restricted and depends on the iomem kernel parameter (honestly I did not entirely understand when this works and when not).
github.com/Velocidex/Linpmem
github.com/504ensicsLabs/LiME
are both kernel modules, and thus neer to be compilef for the specific kernel.
Is there some eBPF tool for memory dumping? Could this be made?
Linux Artifacts: Timestamps of Last SUDO Command Execution: https://cyberdefnerd.com/2024/10/06/linux-artifacts-timestamps-of-last-sudo-command-execution/
If you're interested in getting into #Linux #logging and evidence collection, this is an excellent write-up from @kostastsale that compares #EVTX logs on Windows with #Auditd, #SysMon for Linux, and native Linux logging.
#DFIR #LinuxForensics #SIEM #CSIRT
https://kostas-ts.medium.com/telemetry-on-linux-vs-windows-a-comparative-analysis-849f6b43ef8e
Linux Forensics Analysis Cheatsheet: https://fareedfauzi.github.io/2024/03/29/Linux-Forensics-cheatsheet.html
Linux Forensics Workshop @ DFRWS USA 2023 by Ali Hadi and team. The case used involved a compromised Hadoop cluster with compromised accounts, EoP, lateral movement, & diff persistent mechanisms: https://linuxdfir.ashemery.com/Workshops/DFRWS_USA_2023/
Leo
Tedi Heriyanto
Josh Lemon
0xD 
Simon Taplin