Even though most of you have already probably taken ICS 231, the first part of this module will refresh some Linux basics. We will also dive deeper into the Linux OS and learn new commands or use commands that were learned previously in a new manner. This module has a lot of information, so please practice these commands and become familiar with them. In this module we will learn how to extract volatile information and look at various files that could contain important data to our investigation.
Even though you've been able to recover a file(s), it could be password protected. This section covers various utilities that will help you accomplish this task.
Produce a report from a forensics investigation of a Linux OS. → (LO #2)
Recall that recovered data from a forensic investigation might be password protected. → (LO #2)