Details
0
0
0
s2sdefault

In a bit of a panic, I moved all kinds of grub files, without fully realizing the consequences later on... In any case, I am going over the files that I do have, and noting what differences may exist. If there's anything that would cause my booting problems, it is likely the bootloader, grub.

Read more: Forensics File Analysis 3: grubs Add new comment
0
0
0
s2sdefault

Details
0
0
0
s2sdefault

Here I go over the following files /etc/hosts*

This works out to 3 files total.

Read more: Forensics File Analysis 2: hosts* Add new comment
0
0
0
s2sdefault

Details
0
0
0
s2sdefault

At this point I have managed to get the old HDD mounted and working on my test server and I got all the data off. Now I need to reformat the drive to ensure nothing is left, and get just my data back on so I can use it for my dedicated internal server, and once again have access to my data. Here's how I went about doing so.

Read more: Data Restore Add new comment
0
0
0
s2sdefault

Details
0
0
0
s2sdefault

In this article I am examining the /var/log/auth.log file for any indication of what/what/when my server may have been compromised.

Read more: Forensics File Analysis 1: auth.log 4 comments
0
0
0
s2sdefault

Details
0
0
0
s2sdefault

Now that I have finally managed to get my old HDD mounted, it is time to actually start getting my data off, keeping what I want for analysis, formatting the drive, and getting just my data back on.

What's worth keeping? What isn't needed? I tried looking into a few things, but there was very little to really go on. So how do I gather the files I need for analysis, while being able to otherwise keep my data, and reformat the drive?

Read more: Data Recovery, Part 2 Add new comment
0
0
0
s2sdefault
  1. Step 1: Data Recovery
  2. Hijacked Server?
  • You are here:  
  • Home
  • Forensics