Reference no: EM134012030

Assignment - Exploring Linux

Many of the forensic tools that are used by investigators are available only through the Linux operating system. Examples include file-carving tools like Foremost and Scalpel. Do you remember the hex editing tool lab exercise last week? Wouldn't it be nice to have a program that can scan the entire contents of a forensic image to report on any files that have file extensions that don't match the contents of the file? Tools that can tell if files have been renamed, such as MisIdentify, are only available on Linux. There are even full operating system distribution ISOs such as Metasploit, Kali Linux, Security Onion, and Fedora Security Spin that are Linux based. There is also a powerful mobile forensic device emulator called Santoku that is Linux based. If you are going to pursue a career in Cybersecurity or digital forensics, it will be necessary to familiarize yourself with the Linux operating system platform.

This deliverable for this exercise is ONE MICROSOFT WORD DOCUMENT. Do not upload the individual images that you create as separate deliverables.

PART 1 - Updating and Patching your Linux Distribution

Open your Oracle VirtualBox application and start the Ubuntu Linux operating system that you created in Week 6.

Install Patches and Updates

Once you are logged into Ubuntu, open a terminal session (this is akin to the Command Line Interface in Windows). Click on the ‘Search' button and type ‘Terminal' into the search text block. NOTE - Since this is a new install from just two weeks ago, you may not have any updates or patches to apply. Simply provide screen captures where indicated of what is returned after processing your commands.

Click on the ‘Terminal' application to open a command line window. Note that just like in Windows, the current file path is provided. Alternatively, instead of the ‘>' sign for denoting when you start typing, Linux-based systems tend to use the ‘sign. Although, some versions of Linux use the ‘#' sign.

To apply updates and patches to the operating system, a login with Administrator rights is necessary. This is accomplished by using the ‘sudo' prefix, followed by the execution command ‘apt-get', followed by the instruction ‘update'. So, you will be typing ‘sudo apt-get update'.

Once you apply the sudo prefix, you will have to provide the password. Since you set yourself up as an Administrator when you created this virtual machine, your password will work here.

Collect a screen capture of this execution as verification of the update and paste the screen capture into your Word document.

Following the ‘update' command, you will apply the ‘upgrade' command. Don't worry, this isn't a full upgrade of the operating system. That is accomplished through the ‘upgrade-distro' command. We will not be attempting that in this exercise. You may again be required to provide a password. The full command line is ‘sudo apt-get upgrade'. When the system asks if you're sure, press the ‘y' key and then press <ENTER>.

If you don't want to use the sudo prefix every time you execute a command that requires Administrative privileges, you may change your login to the root user by typing:
$sudo su
By the way, ‘sudo' stands for Super User Do.

Collect a screen capture of this Terminal window as verification of the upgrade and paste the screen capture into your Word document.

Part 2 - Verify the Version of Ubuntu that you're using

Windows provides the user with a convenient ‘Settings' interface that allows the user to see the current operating system version through the ‘About' screen. In Ubuntu, we use the Terminal interface for finding this information. In your existing Terminal session, type the following commands (NOTE - you don't type the $):
$lsb_release -a

Alternatively, you may acquire some additional version information by using the following command:
$cat /etc/issue

There are many occasions where you will need to remind yourself if this was a 32-bit or 64-bit version of the Operating System that you installed. If you didn't include this in the name of the virtual machine, it will be necessary for you to know this for installing additional applications later.
$uname -a (for acquiring the kernel version)

As you can see, this is a 64-bit installation.

Collect a screen capture of this Terminal window as verification of the upgrade and paste the screen capture into your Word document.

Part 4 - Install Antivirus Software

When a new operating system is installed, it is typically necessary to include some form of anti-virus software with this setup. While there are occasions where it is forensically necessary to disable the anti-virus software for your experimentation, it is typical to still have the software installed. In this step, we will install the Linux-based open source anti-virus called Clam-AV. Another popular Linux-based anti-virus system is called Comodo. In your existing Terminal session, type the following commands (NOTE - you don't type the $):

Install ClamAV
$sudo apt-get install clamav

Install updated virus definitions
$sudo freshclam (Note: you may get error - .. is locked by another process. This is because it's updated automatically, if you want to update it manually, you first need to run: sudo systemctl stop clamav-freshclam.service, then run it manually: sudo freshclam)

Run a scan of all files on your Ubuntu virtual machine (the -r parameter is used for all files)
$clamscan -r /

(NOTE - As with Windows, you may use the ‘> clamscan.txt' extension to create a text file output for later review) (NOTE - You may also use the CTRL-C keyboard combination to halt the execution - it does not need to run to completion for this lab exercise)

Display only any infected files (the -i parameter is used for only infected files)
$clamscan -i /

Collect a screen capture of this Terminal window as verification of the update and paste the screen capture into your Word document.

Part 5 - Create a Text File in Linux

There are several built-in text editors in Ubuntu including nano and gedit. Nano is primarily used for creating Terminal scripts for sequential execution, much like batch files in the Windows Command Line Interface. Gedit is a simple GUI-based text editor similar to the Windows Notepad. Create a simple text file using gedit through the Terminal window.
$gedit csc147textfile.txt

When the GUI text editor opens, type something into the window and save it locally. Click on the ‘Save' button in the upper right corner of the gedit screen to retain this text file for use later in this lab exercise.

Collect a screen capture of this gedit window as verification of the upgrade and paste the screen capture into your Word document.

Part 6 - Navigate the Directory Tree in Linux

In Windows, we have the File Explorer GUI window for navigating the operating system file structure. We have similar tools in Ubuntu, but while working in the Terminal window, we have Command Line commands that we can follow.

Create a directory
$mkdir csc147directory

Change to the newly created directory
$cd csc147directory

Create an empty file in this directory
$touch empty.txt

List all of the files in the current directory
$ls

Change back to the previous directory
$cd .. (don't forget the space between the cd and the two periods)

Remove the directory that you just created
$rmdir csc147directory

What happened here? Why wasn't the directory removed?

Determine how much free memory is available on this virtual machine
$free

Determine how much free diskspace is available on this virtual machine
$df -h

But, if you want to know how much space is used by this directory and all of it's contents (including subdirectories)
$du

Display a list of all the commands that you have used up to this point
$history

Notice that there are some other commands that have been applied to this virtual machine. Any idea what they are?

Collect a screen capture of this Terminal window as verification of the upgrade and paste the screen capture into your Word document.

You may now shutdown Ubuntu and close the virtual machine.

Some of you will have used Linux before, and perhaps even Ubuntu. Please share in a brief paragraph at the end of your Work document if there was anything new that you learned while completing this lab exercise.

Create a Microsoft Word document. Use the naming convention for the document so that it comprises your last name and the lab number. For example, the filename should be YourLastName_Lab8.docx (i.e. if your last name is Smith, the filename would be Smith_Lab8.docx). Upload this ONE FILE to the Blackboard dropbox as the deliverable for this exercise.

This completes the requirements for Lab Exercise 8.2.

If you are having trouble collecting screen captures from the virtual machine, you may have some additional success if you open another window (I use the File Explorer) in the Windows primary display, but off to the side from the virtual machine window. When you have the virtual machine where you want it for the screen capture, change focus to the File Explorer and use the CTRL-PrtScn keystroke combination. That will capture everything on the screen. Then you can paste directly into your Word document though the CTRL-V keystroke combination. Simply trim off the bits you don't want (the File Explorer window) and save the Word document with the appropriate screen capture.

You can also use Snipping Tool by pressing the Window button on your keyboard and type: snipping tool, then click ok. It will open the tool and you can use it to take a snapshot of your screen.