802 lines
25 KiB
Markdown
802 lines
25 KiB
Markdown
# [++] Forensic report of case: dif_gutachten
|
||
|
||
## [++] Description
|
||
Forensisches Gutachten im Fall Tilo Barkholz
|
||
|
||
|
||
## [++] Timeline of Commands and Comments
|
||
|
||
### [+] Command: `file ForImage2.img`
|
||
- Timestamp: `2025-07-14T18-03-17-505557+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `7bf5d482601016dfe39f3de29aad7f83b3a0f59d3177828e1f1823817b1778d8`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
ForImage2.img: QEMU QCOW Image (v3), 35433480192 bytes (v3), 35433480192 bytes
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `file ForImage2.img`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:40:59.760772+02:00
|
||
|
||
`file` identifies file types by examining magic numbers and headers. Useful for verifying or correcting file extensions and detecting anomalies.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-05-10-852941+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Der file-Befehl wurde verwendet, um das Format des Abbilds zu bestimmen. Dabei wurde erkannt, dass es sich um ein QCOW2-Image handelt, ein haeufig genutztes Format fuer virtuelle Maschinen unter QEMU/KVM
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-06-02-925862+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Wir werden nun Partitionen im Image identifizieren, um sie zu extrahiern & zu analysieren
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo modprobe nbd max_part=8`
|
||
- Timestamp: `2025-07-14T18-06-22-301370+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo modprobe nbd max_part=8`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:40:59.839755+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo: qemu-nbd: command not found`
|
||
- Timestamp: `2025-07-14T18-06-51-644697+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `7bd21e679c39eb29ea0eebe56f0a54110538c4bdb094fbbd9d7b9e8d7c2a7ed4`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[!] Command failed:
|
||
sudo: qemu-nbd: command not found
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo: qemu-nbd: command not found`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:40:59.860730+02:00
|
||
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `qemu-nbd: unrecognized option '--conect=/dev/nbd0'`
|
||
- Timestamp: `2025-07-14T18-07-49-932393+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `23ec6e05fb897e4b0ad2d77613416100a2fcd3f300135a2e5677364b4b115d74`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[!] Command failed:
|
||
qemu-nbd: unrecognized option '--conect=/dev/nbd0'
|
||
qemu-nbd: Try `qemu-nbd --help' for more information.
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `qemu-nbd: unrecognized option '--conect=/dev/nbd0'`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:40:59.889332+02:00
|
||
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo qemu-nbd --connect=/dev/nbd0 ForImage2.img`
|
||
- Timestamp: `2025-07-14T18-08-00-970730+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo qemu-nbd --connect=/dev/nbd0 ForImage2.img`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:40:59.907323+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo fdisk -l /dev/nbd0`
|
||
- Timestamp: `2025-07-14T18-08-17-811009+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `4a2bcce842d23a7b6e392a9e547e0942145cdd7450910980c116667d81b5078a`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
Disk /dev/nbd0: 33 GiB, 35433480192 bytes, 69206016 sectors
|
||
Units: sectors of 1 * 512 = 512 bytes
|
||
Sector size (logical/physical): 512 bytes / 512 bytes
|
||
I/O size (minimum/optimal): 512 bytes / 131072 bytes
|
||
Disklabel type: gpt
|
||
Disk identifier: 7AB35F56-8FB0-407B-AC62-FD7C3E10AB6A
|
||
|
||
Device Start End Sectors Size Type
|
||
/dev/nbd0p1 2048 4095 2048 1M BIOS boot
|
||
/dev/nbd0p2 4096 1054719 1050624 513M EFI System
|
||
/dev/nbd0p3 1054720 46135295 45080576 21.5G Linux filesystem
|
||
/dev/nbd0p4 46874624 68360191 21485568 10.2G Microsoft basic data
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo fdisk -l /dev/nbd0`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:40:59.937090+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`fdisk` is an interactive command-line tool to create, delete, and manage partitions on storage devices.
|
||
|
||
|
||
Lists partition tables of all recognized devices.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-09-46-180536+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Das QCOW2-Image wurde mit qemu-nbd als Blockgerät bereitgestellt, um anschließend mit fdisk die Partitionstabelle und Dateisystemtypen zu identifizieren – ein essenzieller Schritt zur Strukturaufklärung und Vorbereitung weiterer Analysen.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-10-39-291304+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Hierbei haben wir vier Partitionen entdeckt, die wir nun naeher untersuchen werden
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mmls /dev/nbd0`
|
||
- Timestamp: `2025-07-14T18-10-44-804259+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `1e7e7d7d86604a62aceffd32db9f4f6f897f22c84de9f2367b46bf6fa4d9b77b`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
GUID Partition Table (EFI)
|
||
Offset Sector: 0
|
||
Units are in 512-byte sectors
|
||
|
||
Slot Start End Length Description
|
||
000: Meta 0000000000 0000000000 0000000001 Safety Table
|
||
001: ------- 0000000000 0000002047 0000002048 Unallocated
|
||
002: Meta 0000000001 0000000001 0000000001 GPT Header
|
||
003: Meta 0000000002 0000000033 0000000032 Partition Table
|
||
004: 000 0000002048 0000004095 0000002048
|
||
005: 001 0000004096 0001054719 0001050624 EFI System Partition
|
||
006: 002 0001054720 0046135295 0045080576
|
||
007: ------- 0046135296 0046874623 0000739328 Unallocated
|
||
008: 003 0046874624 0068360191 0021485568 FAT
|
||
009: ------- 0068360192 0069206015 0000845824 Unallocated
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mmls /dev/nbd0`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:40:59.975491+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mmls` analyzes the partition layout of a disk image without modifying it. It shows partitions, offsets, and sizes — a typical forensic step before mounting.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-11-51-739620+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Die Analyse mit mmls dient der genauen Bestimmung der Partitionsstruktur und der Start-Offsets, was erforderlich ist, um gezielt Dateien zu extrahieren und das Dateisystem forensisch korrekt zu analysieren.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-13-42-016732+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Die mmls-Ausgabe zeigt vier Partitionen. Drei davon sind relevant für die Analyse – die BIOS-Boot-Partition (nur 1 MB) enthält keine Nutzdaten und wird daher übersprungen.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-13-51-840180+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Die Partitionen 005 (EFI), 006 (Linux-Dateisystem) und 008 (Microsoft-Dateisystem) werden einzeln gemountet und analysiert, um strukturierte und nachvollziehbare Ergebnisse zu erhalten.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-13-59-612800+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Eine sequentielle Analyse aller nutzbaren Partitionen erlaubt eine saubere Trennung der Datenquellen und kann forensisch besser dokumentiert werden.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mkdir -p /mnt/efi /mnt/linuxfs /mnt/windows`
|
||
- Timestamp: `2025-07-14T18-16-06-814084+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mkdir -p /mnt/efi /mnt/linuxfs /mnt/windows`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:40:59.996144+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mkdir` creates a directory. In forensic workflows, it is often used to prepare target folders for mounts or exported data.
|
||
|
||
|
||
The `-p` option ensures that parent directories are created as needed. It also avoids errors if the target directory already exists.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-16-14-867728+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Drei dedizierte Mount-Verzeichnisse wurden erstellt, um die Partitionen getrennt voneinander und nachvollziehbar analysieren zu können.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mount -o ro /dev/nbd0p3 /mnt/linuxfs`
|
||
- Timestamp: `2025-07-14T18-18-28-516252+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mount -o ro /dev/nbd0p3 /mnt/linuxfs`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.016107+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
|
||
The `-o` option sets mount parameters — e.g., to enable read-only mode or suppress timestamp changes.
|
||
|
||
|
||
`ro` stands for "read-only". It ensures that the mounted filesystem is not modified. This is critical in digital forensics.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-18-36-250749+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Das Linux-Dateisystem wurde readonly in /mnt/linuxfs eingebunden, um die Hauptdatenstruktur des Betriebssystems forensisch zu untersuchen.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mount -o ro /dev/nbd0p4 /mnt/windows`
|
||
- Timestamp: `2025-07-14T18-18-44-352022+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mount -o ro /dev/nbd0p4 /mnt/windows`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.034851+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
|
||
The `-o` option sets mount parameters — e.g., to enable read-only mode or suppress timestamp changes.
|
||
|
||
|
||
`ro` stands for "read-only". It ensures that the mounted filesystem is not modified. This is critical in digital forensics.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-18-48-788722+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Die als 'Microsoft Basic Data' gekennzeichnete Partition wurde readonly in /mnt/windows eingebunden, vermutlich zur Analyse von Benutzerdaten oder Überresten eines Dual-Boot-Systems.
|
||
|
||
---
|
||
|
||
### [+] Command: `qemu-nbd: Failed to blk_new_open 'ForImage2.img': Failed to get "write" lock`
|
||
- Timestamp: `2025-07-14T18-20-16-782579+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `927576f78ad2da1d55b32d2e32af8a13ec8a59dcde4168fcfbea80ab6c3161be`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[!] Command failed:
|
||
qemu-nbd: Failed to blk_new_open 'ForImage2.img': Failed to get "write" lock
|
||
Is another process using the image [ForImage2.img]?
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `qemu-nbd: Failed to blk_new_open 'ForImage2.img': Failed to get "write" lock`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.052907+02:00
|
||
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `mount | grep /mnt`
|
||
- Timestamp: `2025-07-14T18-26-37-707012+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `064de49535ebcda317b47383a76e27d37389b0e7b710cfa86f0437592927437a`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
/dev/nbd0p3 on /mnt/linuxfs type ext4 (ro,relatime)
|
||
/dev/nbd0p4 on /mnt/windows type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `mount | grep /mnt`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.071170+02:00
|
||
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
---
|
||
|
||
### [+] Command: `mount | grep /mnt`
|
||
- Timestamp: `2025-07-14T18-27-36-979838+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `064de49535ebcda317b47383a76e27d37389b0e7b710cfa86f0437592927437a`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
/dev/nbd0p3 on /mnt/linuxfs type ext4 (ro,relatime)
|
||
/dev/nbd0p4 on /mnt/windows type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `mount | grep /mnt`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.089190+02:00
|
||
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mount -o ro /dev/nbd0p2 /mnt/efi`
|
||
- Timestamp: `2025-07-14T18-28-47-827648+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mount -o ro /dev/nbd0p2 /mnt/efi`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.107459+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
|
||
The `-o` option sets mount parameters — e.g., to enable read-only mode or suppress timestamp changes.
|
||
|
||
|
||
`ro` stands for "read-only". It ensures that the mounted filesystem is not modified. This is critical in digital forensics.
|
||
|
||
---
|
||
|
||
### [+] Command: `mount | grep /mnt`
|
||
- Timestamp: `2025-07-14T18-28-49-632890+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `5701af33c9936d5a4213bdc9ce95b07383533c58de3746fdb6cb08961ebc76d9`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
/dev/nbd0p3 on /mnt/linuxfs type ext4 (ro,relatime)
|
||
/dev/nbd0p4 on /mnt/windows type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
|
||
/dev/nbd0p2 on /mnt/efi type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `mount | grep /mnt`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.125685+02:00
|
||
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-29-46-776359+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Nun sind alle drei Partitionen von Interesse korrekt eingebunden und die Arbeit kann beginnen
|
||
|
||
---
|
||
|
||
### [+] Command: `mount | grep /mnt`
|
||
- Timestamp: `2025-07-14T20-08-59-917952+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `5701af33c9936d5a4213bdc9ce95b07383533c58de3746fdb6cb08961ebc76d9`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
/dev/nbd0p3 on /mnt/linuxfs type ext4 (ro,relatime)
|
||
/dev/nbd0p4 on /mnt/windows type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
|
||
/dev/nbd0p2 on /mnt/efi type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `mount | grep /mnt`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.144446+02:00
|
||
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T20-13-50-520875+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Wir beginnen mit /mnt/linuxfs. Die Analyse der Linux-Systempartition dient der Erfassung benutzerspezifischer und systemweiter Artefakte, welche Rückschlüsse auf Nutzung, Konfiguration und potenziell sicherheitsrelevante Aktivitäten ermöglichen.
|
||
|
||
---
|
||
|
||
### [+] Command: `ls -la /mnt/linuxfs/home`
|
||
- Timestamp: `2025-07-14T20-13-56-887462+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `f6768291b43b3d15242a63a188af4eef9bb76d1d7b0c857ca045103d57b8f2ad`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
total 20
|
||
drwxr-xr-x 5 root root 4096 Jul 4 2022 .
|
||
drwxr-xr-x 20 root root 4096 Jul 2 2022 ..
|
||
drwxr-x--- 16 1001 1001 4096 Jul 4 2022 belle
|
||
drwxr-x--- 3 1002 1002 4096 Jul 4 2022 kiara
|
||
drwxr-x--- 18 kali kali 4096 Jul 4 2022 pc
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `ls -la /mnt/linuxfs/home`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.163176+02:00
|
||
|
||
`ls` lists files in a directory. It is used to gain an overview and does not modify data.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T20-14-29-073825+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Wir verzeichnen drei User-Accounts, pc, belle und kiara.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T20-15-13-781491+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Bevor wir zu diesen im Einzelnen kommen, ueberpruefen wir systemweite Konfigurationen und Logs
|
||
|
||
---
|
||
|
||
### [+] Command: `ls -la /mnt/linuxfs/var/log`
|
||
- Timestamp: `2025-07-14T20-17-03-043108+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `957a55a20047fe1e5639161fe828af67ba54211b33fcdb9974be18261331cacb`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
total 5336
|
||
drwxrwxr-x 13 root pulse 4096 Jul 4 2022 .
|
||
drwxr-xr-x 14 root root 4096 Apr 19 2022 ..
|
||
-rw-r--r-- 1 root root 21410 Jul 2 2022 alternatives.log
|
||
-rw-r----- 1 root adm 0 Jul 4 2022 apport.log
|
||
-rw-r----- 1 root adm 2369 Jul 2 2022 apport.log.1
|
||
drwxr-xr-x 2 root root 4096 Jul 4 2022 apt
|
||
-rw-r----- 1 tcpdump adm 80955 Jul 4 2022 auth.log
|
||
-rw------- 1 root root 34617 Jul 4 2022 boot.log
|
||
-rw------- 1 root root 33348 Jul 4 2022 boot.log.1
|
||
-rw-r--r-- 1 root root 108494 Apr 19 2022 bootstrap.log
|
||
-rw-rw---- 1 root utmp 0 Apr 19 2022 btmp
|
||
drwxr-xr-x 2 root root 4096 Jul 4 2022 cups
|
||
drwxr-xr-x 2 root root 4096 Apr 18 2022 dist-upgrade
|
||
-rw-r----- 1 root adm 68118 Jul 4 2022 dmesg
|
||
-rw-r----- 1 root adm 69151 Jul 4 2022 dmesg.0
|
||
-rw-r----- 1 root adm 16776 Jul 4 2022 dmesg.1.gz
|
||
-rw-r----- 1 root adm 17536 Jul 4 2022 dmesg.2.gz
|
||
-rw-r----- 1 root adm 17273 Jul 4 2022 dmesg.3.gz
|
||
... (truncated, showing first 20 and last 10 lines)
|
||
drwxr-xr-x 2 root root 4096 Mar 22 2022 openvpn
|
||
drwx------ 2 root root 4096 Apr 19 2022 private
|
||
drwx------ 2 Debian-snmp root 4096 Jan 8 2022 speech-dispatcher
|
||
-rw-r----- 1 tcpdump adm 2865079 Jul 4 2022 syslog
|
||
-rw-r--r-- 1 root root 0 Apr 19 2022 ubuntu-advantage.log
|
||
-rw-r--r-- 1 root root 631 Jul 4 2022 ubuntu-advantage-timer.log
|
||
drwxr-x--- 2 root adm 4096 Jul 3 2022 unattended-upgrades
|
||
-rw-rw-r-- 1 root utmp 31872 Jul 4 2022 wtmp
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `ls -la /mnt/linuxfs/var/log`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.182010+02:00
|
||
|
||
`ls` lists files in a directory. It is used to gain an overview and does not modify data.
|
||
|
||
---
|
||
|
||
### [+] Command: `ls -la /mnt/linuxfs/etc`
|
||
- Timestamp: `2025-07-14T20-18-24-994518+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `55c42303907eb58bc29c73525cdde2ef75ba9aa595050b19496e142c3743a22f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
total 1120
|
||
drwxr-xr-x 128 root root 12288 Jul 4 2022 .
|
||
drwxr-xr-x 20 root root 4096 Jul 2 2022 ..
|
||
drwxr-xr-x 3 root root 4096 Apr 19 2022 acpi
|
||
-rw-r--r-- 1 root root 3028 Apr 19 2022 adduser.conf
|
||
drwxr-xr-x 3 root root 4096 Apr 19 2022 alsa
|
||
drwxr-xr-x 2 root root 4096 Jul 3 2022 alternatives
|
||
-rw-r--r-- 1 root root 335 Mar 23 2022 anacrontab
|
||
-rw-r--r-- 1 root root 433 Mar 23 2022 apg.conf
|
||
drwxr-xr-x 5 root root 4096 Apr 19 2022 apm
|
||
drwxr-xr-x 3 root root 4096 Apr 19 2022 apparmor
|
||
drwxr-xr-x 8 root root 4096 Jul 3 2022 apparmor.d
|
||
drwxr-xr-x 3 root root 4096 Jul 3 2022 apport
|
||
-rw-r--r-- 1 root root 769 Feb 22 2022 appstream.conf
|
||
drwxr-xr-x 8 root root 4096 Jul 2 2022 apt
|
||
drwxr-xr-x 3 root root 4096 Apr 19 2022 avahi
|
||
-rw-r--r-- 1 root root 2319 Jan 6 2022 bash.bashrc
|
||
-rw-r--r-- 1 root root 45 Nov 11 2021 bash_completion
|
||
drwxr-xr-x 2 root root 4096 Jul 3 2022 bash_completion.d
|
||
... (truncated, showing first 20 and last 10 lines)
|
||
drwxr-xr-x 5 root root 4096 Apr 19 2022 vulkan
|
||
-rw-r--r-- 1 root root 4942 Jan 24 2022 wgetrc
|
||
drwxr-xr-x 2 root root 4096 Apr 19 2022 wpa_supplicant
|
||
drwxr-xr-x 12 root root 4096 Apr 19 2022 X11
|
||
-rw-r--r-- 1 root root 681 Mar 23 2022 xattr.conf
|
||
drwxr-xr-x 6 root root 4096 Apr 19 2022 xdg
|
||
drwxr-xr-x 2 root root 4096 Apr 19 2022 xml
|
||
-rw-r--r-- 1 root root 460 Dec 8 2021 zsh_command_not_found
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `ls -la /mnt/linuxfs/etc`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.200282+02:00
|
||
|
||
`ls` lists files in a directory. It is used to gain an overview and does not modify data.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T20-19-31-817078+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Applikationen, die ins Auge fallen: speech-dispatcher, security
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T20-20-29-497721+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Beginnen wir nun mit dem User-Account 'belle'
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T20-24-57-659634+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Zur beweissicheren Sicherung der Nutzerverzeichnisse wurden die Home-Verzeichnisse der identifizierten Accounts (belle, kiara, pc) aus der gemounteten Partition /mnt/linuxfs mittels tar archiviert. Die Sicherung erfolgte im Read-Only-Modus zur Wahrung der Integrität.
|
||
|
||
---
|
||
|
||
### [+] Command: `tar (child): /home/kali/Documents/dif_auswertung/belle_home.tar.gz: Cannot open: No such file or directory`
|
||
- Timestamp: `2025-07-14T20-25-28-820189+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `e186e24efe2970d43583e5551223221c7a714bfab92e4721092ac3f97af4d19d`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[!] Command failed:
|
||
tar (child): /home/kali/Documents/dif_auswertung/belle_home.tar.gz: Cannot open: No such file or directory
|
||
tar (child): Error is not recoverable: exiting now
|
||
tar: /home/kali/Documents/dif_auswertung/belle_home.tar.gz: Cannot write: Broken pipe
|
||
tar: Child returned status 2
|
||
tar: Error is not recoverable: exiting now
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `tar (child): /home/kali/Documents/dif_auswertung/belle_home.tar.gz: Cannot open: No such file or directory`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.220927+02:00
|
||
|
||
`tar` is used to create and extract archive files. In forensics, it’s useful for packaging or reviewing archived evidence sets.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mkdir -p ~/Documents/auswertung/`
|
||
- Timestamp: `2025-07-14T20-30-04-249825+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mkdir -p ~/Documents/auswertung/`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.238957+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mkdir` creates a directory. In forensic workflows, it is often used to prepare target folders for mounts or exported data.
|
||
|
||
|
||
The `-p` option ensures that parent directories are created as needed. It also avoids errors if the target directory already exists.
|
||
|
||
---
|
||
|
||
### [+] Command: `Error opening image file (raw_open: file "/dev/nbd0p3" - Permission denied)`
|
||
- Timestamp: `2025-07-14T20-30-36-090820+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `cc9dda0ce603430217d5dc755d2c2e3486fd1ea9dbf2bc073eb00f383b03a3f8`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[!] Command failed:
|
||
Error opening image file (raw_open: file "/dev/nbd0p3" - Permission denied)
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `Error opening image file (raw_open: file "/dev/nbd0p3" - Permission denied)`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.257451+02:00
|
||
|
||
This does not appear to be a valid command. It may be the result of a misinterpreted log line or a failed execution attempt.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo tsk_recover -a /dev/nbd0p3 ~/Documents/auswertung/linuxfs_recover`
|
||
- Timestamp: `2025-07-14T20-30-46-797786+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `215260492c038b4f3647587ef8a654cb227f0fa6748911259c0dcc83c3e40b1a`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
Files Recovered: 161794
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo tsk_recover -a /dev/nbd0p3 ~/Documents/auswertung/linuxfs_recover`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T20:41:00.274845+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
|
||
## [+] GPG-Overview
|
||
Each `.log`-file was digitally signed with GPG where applicable.
|
||
The signature status is documented per command.
|