Forensics articles

Last change: 2025-01-06

Got a busy Linux systems and wondering what the culprit is? Learn how to monitor them and focus on disk activity with tools like iotop, sar, vmstat, or iostat.

Last change: 2025-01-06

Symbolic links may point to a directory or a file. Learn how to use the find command to discover symbolic links that refer to a directory.

Last change: 2025-01-10

The command smem can help showing memory usage, including the usage of swap. Here are the most common options explained.

Last change: 2025-01-06

Need to delete the contents of a sensitive file on Linux? Instead of just deleting it with rm, have a look at some other options for a more secure deletion.

Last change: 2025-01-06

Linux may store the initial creation of a file. Learn how to use the stat command to find this initial creation time of a file, also known as its birth time.

Last change: 2025-01-06

Linux memory management is an extensive subject. This guide helps you understanding the how to analyze it and obtain available memory information.

Last change: 2025-01-06

Learn how to determine the details of most types of files on Linux, together with the understanding how these tools do their job.

Last change: 2025-01-06

In-depth article about auditing Linux processes. Determination of running processes, memory and on-disk structure and the proper tools for analyzing them.

Last change: 2025-01-06

Guide for auditing Linux systems by using the audit daemon and related utilities. This powerful audit framework has many possibilities for auditing Linux.

Last change: 2025-01-06

Is your Linux system compromised or does it run suspicious processes? Learn how to investigate the system and create an action plan.