CHFI (312-49) Digital Forensics Simulation

Develop your forensic analysis capabilities. In this scenario, you will apply the digital forensics process to identify and analyze specific Linux log artifacts related to unauthorized access attempts.

Investigation Scenario

A regional financial organization headquartered in Denver, Colorado, detected abnormal outbound network traffic originating from a critical Linux-based database front-end server (Ubuntu 22.04 LTS). The incident response team suspects an initial compromise via an SSH brute-force attack.

The system has been isolated from the network, and a forensic investigator has been tasked with analyzing the live system's artifacts. The primary objective is to review the system logs to identify the threat actor's entry vector, extract the source IP addresses of the brute-force attempts, and establish an incident timeline.

Evidence Collected

The forensic team performed a logical extraction of the server's logging directory. The following directory listing represents a subset of the collected artifacts.

Acquisition Type: Logical File Copy Target OS: Linux (Ubuntu 22.04 LTS) Target Path: /var/log/ Directory Listing Extract: -rw-r----- 1 syslog adm 1.2M Oct 24 09:12 auth.log -rw-r--r-- 1 root root 84K Oct 24 08:30 dmesg -rw-r----- 1 syslog adm 4.5M Oct 24 09:15 syslog -rw-rw-r-- 1 root utmp 286K Oct 24 09:10 wtmp -rw-rw---- 1 root utmp 14K Oct 24 08:55 btmp Investigator notes: "Need to parse the specific text-based log file that records Pluggable Authentication Module (PAM) events and SSH daemon login failures to map the attacker's IP infrastructure."

Question

During a forensic examination of a Linux-based server in Denver, Colorado, an investigator needs to review the system logs for evidence of failed login attempts. Which file in the /var/log/ directory should the investigator examine?

Forensic Hint: Think about the logging facility dedicated to user authorization and authentication. The sshd daemon routes all connection success and failure events specifically to this log.

Expert Analysis

1. What the evidence shows

The evidence reveals a logical extraction of the `/var/log/` directory from a Linux server. Multiple standard logging files are present, including those that handle general system messages, kernel events, and authentication events.

2. Identify forensic stage

This scenario represents the Examination and Analysis phase. The data collection has already occurred, and the investigator must now identify the correct specific artifact containing the relevant evidentiary data (failed login attempts).

3. Why correct answer is correct

A. auth.log (or secure) is correct. In Debian/Ubuntu-based Linux distributions, `auth.log` is the dedicated file used by the system logging daemon (e.g., rsyslog) to record all authentication-related events, including SSH logins, `su` switch user commands, and `sudo` executions. On RHEL/CentOS systems, the equivalent file is named `secure`. Analyzing this file is the definitive method for proving brute-force attacks and unauthorized access attempts.

4. Why others are wrong

B. syslog: This file captures general system activity and application logs that do not fit into specific categories. While valuable for general troubleshooting, authentication events are deliberately routed away from `syslog` to maintain security context.
C. messages: This is the RHEL/CentOS equivalent of Debian's `syslog`. Like `syslog`, it captures general global system messages, not user authentication events.
D. dmesg: This file stores the kernel ring buffer logs. It is primarily used to analyze hardware events, device driver initializations, and boot-up messages, making it completely irrelevant for investigating user login activities.

5. Real-world forensic action

A forensic investigator would use command-line utilities to quickly triage the file. For example, running `grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -nr` would carve out the source IP addresses of the attackers and count the number of brute-force attempts from each IP.

6. MINI LESSON: Linux Log Artifacts

Authentication Tracking: Always look to `/var/log/auth.log` (Debian/Ubuntu) or `/var/log/secure` (RHEL/CentOS) for SSH, PAM, and sudo activity.
Binary Login Logs: While `auth.log` is plain text, `wtmp` and `btmp` are binary files. `btmp` specifically tracks bad/failed login attempts and must be read using the `lastb` command, while `wtmp` tracks successful logins via the `last` command.
Artifact Interpretation: Timezones matter. Always verify if the logs are recorded in local time or UTC before building an incident timeline.

Ready for the next case?

Enhance your CHFI preparation with more realistic digital forensics simulations.

Explore more CHFI simulations