Criação e avaliação de cenários forenses em sistemas Linux

Abstract

Digital forensics poses a critical role in investigating crimes involving digital media as it provides the foundation for the collection, examination, and analysis of evidence stored in electronic devices. In order to facilitate studies, research, and tools development in the field of digital forensics, it is necessary to have scenarios that closely resemble real-world situations. However, due to privacy and confidentiality concerns surrounding actual crime scenarios, they are not publicly available. Therefore, the aim of this work was to create, evaluate, and disclosure forensic scenarios in Linux systems by virtualizing two distributions, namely Ubuntu and CentOS, utilizing Linux system commands and open-source forensic tools for scenario evaluation. In this way, two distinct scenarios were created based on hypothetical crimes, with the first scenario involving a fictional crime of possession of child sexual abuse and exploitation-related content. It consisted of various challenges, such as deleted evidence, encrypted data, hidden steganography, password-protected compressed files. The second scenario, on the other hand, revolves around a fictional company server that was attacked by a cracker, requiring investigation into the actions taken and the identification of traces left by him. Both scenarios were publicly released in two repositories, including English-language documentation, system images, and the virtual machine’s OVA file.