In this lesson, you will learn how to reconstruct the timeline of a security breach by leveraging historical Linux audit data to trace file access patterns.
The Detective’s View: Reconstructing the Timeline
When a security incident occurs, a simple "file accessed" alert isn't enough to understand the scope of the damage. To perform advanced forensic analysis, we must treat audit logs as a chronological narrative. By correlating auditd event IDs with specific user sessions and process trees, we can determine the "patient zero" event—the moment an attacker first interacted with a sensitive file.
Sequence Analysis with Audit Logs
Most forensic investigations rely on the ausearch utility to pull data from /var/log/audit/audit.log. When investigating a file access, we look for two primary event types: PATH (the file being touched) and SYSCALL (the action taken).
Consider a scenario where an unauthorized script modified a configuration file. We can trace this by searching for the specific inode of the file:
# Search for events related to a specific file's inode
ausearch -f /etc/shadow -i
This command returns a list of system calls (like openat, write, or rename) indexed by time. To reconstruct the sequence, look for the Process ID (pid) and the Parent Process ID (ppid) associated with these calls. If you see a write call on /etc/shadow originating from a shell process (bash) that was spawned by a web server process (www-data), you have successfully linked the initial web-based vulnerability to the final file-system tampering.
Mapping the Chain of Events
Reconstruction is about connecting the dots:
- Identify the Inode: Use
ls -ito ensure you are tracking the correct file, even if it was renamed. - Isolate the Window: Use
ausearch -ts [start_time] -te [end_time]to filter the noise. - Trace the Parentage: Follow the
ppidchain back to the entry point (e.g., a network socket or a Cron job).
By mapping the process lineage through the audit logs, you can prove exactly which commands were executed leading up to the modification, allowing you to bridge the gap between a generic "access" event and a malicious intent.
Key Takeaway: Advanced forensic analysis transforms raw logs into a sequence of events by chaining process IDs and timestamps to reconstruct the exact path an attacker took to interact with a specific file.