Collect the Evidence in Order of Volatility

Scenario

Tidewater Claims Group's security team has flagged the Ubuntu workstation tw-claims-ws07. It belongs to Ravi Singh, a claims adjuster who has been on leave since last Friday. His account, rsingh, is signed in over SSH from outside the building. The workstation is also sending data to an address nobody recognizes. Ines Okafor, the incident response lead, wants the evidence collected before the network team isolates the machine. You are the IT technician at its console. Her instructions: - Keep a list of SHA-256 checksums of everything you collect, in a file named SHA256SUMS in /mnt/evidence. The next handler has to be able to check it with sha256sum -c, and it has to cover every file you collected, so make it last. It lists the other files, never itself: if a SHA256SUMS already exists when you run the checksums again, it ends up in the list and fails its own check, so delete it first. The copy of claimdesk.log.1 you make as root is readable by root only (the other two logs stay readable by you), so make the list and check it with sudo. On this drive sha256sum * also prints "sha256sum: lost+found: Is a directory": that is the file system's own folder, not a file, and it is normal. - Collect in order of volatility: the live state first, then the logs. The four live captures are one tier, so their order among themselves does not matter. - Everything goes on the evidence drive, mounted at /mnt/evidence. Nothing goes on the workstation's own disk: no copy of a log, and no capture or draft of the processes, sockets or logins, in your home folder or in /tmp. - Copy three logs into /mnt/evidence, keeping their names: /var/log/auth.log.1, /var/log/syslog.1 and /var/log/claimdesk/claimdesk.log.1, the log of the ClaimDesk claims app. The break-in is in these rotated files. Leave the originals where they are. Each copy must still show the same modification time as its original. - Leave the workstation running as it is. Do not stop, kill or pause any process or service (NetworkManager, the print service, the log daemon and the name resolver included), sign anyone out or reboot. Leave the attacker's file in /tmp/.font-unix as it is (do not delete, move, touch, chmod or chown it), and leave rsingh's session and his home folder in place: they are evidence. The network team contains the machine after you hand over the evidence. - Save the state of the live machine in four files in /mnt/evidence: arp.txt, the ARP cache, the table of nearby machines and their hardware addresses; ps.txt, every process running; ss.txt, every TCP and UDP socket, listening and connected, with the process that owns each one; and w.txt, who is logged in and where from. A memory image isn't simulated in this lab. Collect what the terminal can show. The workstation is at its boot menu. Log in as Bench Technician with the password Tech!23; sudo asks for the same password. Don't sign in as rsingh. The Terminal is on the dock.

These instructions stay visible beside the lab while you work.You can reread these instructions in the lab at any time.