Linux forensics labs, one case at a time
Linux incident response, as the FOR577 objectives frame it, expects an examiner who can work a server from what it recorded: read auth.log for failed and successful logins, read a memory image for what was running, find every place a Linux host can hide persistence, follow a web request from the access log into the shell history, and correlate one intrusion across every log on the box.
This pathway is short and steep. It starts with a single auth.log and a First Look at a LiME memory image, sweeps a server for every way back in, reads access, auth and shell logs on a web-server intrusion from first request to last, and finishes with an expert capstone that correlates five host artifacts into one timeline.
5 cases · ~5 h 34 min of lab time · Easy to Expert · a different variant for everyone · verified answer keys
The pathway, in order
5 cases, about 5 h 34 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
First Look: Who Logged Into the Server
Read auth.log: brute force, the login that worked, and what followed.
EASY~33 minUp to 15 questions -
02
First Look: Linux Memory
Read processes, sockets and bash history from a LiME memory image.
EASY~36 minUp to 15 questions -
03
House Keys (Backdoors on a Linux Server)
Sweep a Linux server for every way back in.
MEDIUM~1 h 6 minUp to 20 questions -
04
Rabbit Hole (Web Shell on a Linux Web Server)
Read access, auth and shell logs from first request to last.
HARD~1 h 30 minUp to 20 questions -
05
Open House (Anatomy of a Server Takeover)
Expert capstone: correlate five host logs into one timeline.
EXPERT~1 h 49 minUp to 20 questions
What this pathway covers
Who it's for
- Candidates preparing for a Linux forensics course or exam who want log-based reps that open in a terminal with grep and awk.
- Instructors who need a Linux unit in a Windows-heavy course and want five graded labs that fit in two weeks.
- Sysadmins and SREs moving into security who know the files and need practice reading them as evidence.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
macOS Forensics
Investigating an Apple endpoint: download provenance, privacy consent, persistence, and insider exfiltration.
6 cases · ~6 h 3 min · SANS FOR518
DFIR Analyst Onboarding
The first-look triage skills across every evidence family, in the order a new analyst should meet them.
10 cases · ~6 h 22 min
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.