diff --git a/scripts/artifacts/bashHistory.py b/scripts/artifacts/bashHistory.py index 39758cc3..360e94e8 100644 --- a/scripts/artifacts/bashHistory.py +++ b/scripts/artifacts/bashHistory.py @@ -44,13 +44,15 @@ "no time. On pc_mus_001_win11 a .bash_history in a Windows user profile " "folder held 383 lines and no stamp: 368 rows, Time (UTC) blank on all of them, and 15 empty lines. " "On the public MacBook Pro logical extraction root's .bash_history, in private/var/root and " - "System/Volumes/Data/private/var/root, held one line each and no stamp.", + "System/Volumes/Data/private/var/root, held one line each and no stamp. On honeynet_fc7_debian5 " + "root's .bash_history held 57 lines and no stamp: 57 rows, Time (UTC) blank on all of them.", "paths": ('*/.bash_history',), "output_types": ["html", "tsv", "lava"], "artifact_icon": "terminal", "sample_data": { "af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)", "dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)", + "honeynet_fc7_debian5": "Debian 5.0.7 i386 | 57 rows", "lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)", "pc_mus_001_win11": "Windows 11 22H2 build 22621 | 368 rows", "szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)", diff --git a/scripts/artifacts/linuxAccounts.py b/scripts/artifacts/linuxAccounts.py index 2148d446..8ce82853 100644 --- a/scripts/artifacts/linuxAccounts.py +++ b/scripts/artifacts/linuxAccounts.py @@ -53,7 +53,10 @@ "/usr/sbin/nologin on 41, /bin/false on 5, /bin/bash on 2 and /bin/sync " "on 1. Other Groups was filled on 3 accounts, and for each of them " "Primary Group and Other Groups name the same groups the id command " - "reported for that account on the running system the same day.", + "reported for that account on the running system the same day. On honeynet_fc7_debian5 " + "the file held 23 accounts: Password Field held the same value, x, on all 23, Shell was " + "/bin/sh on 17, /bin/bash on 2, /bin/false on 2, /bin/sync on 1 and /usr/sbin/nologin on " + "1, and Other Groups was filled on 1 account.", "paths": ('*/etc/passwd', '*/etc/group'), "output_types": ["html", "tsv", "lava"], "artifact_icon": "users", @@ -61,6 +64,7 @@ "af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)", "dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (passwd and group only under private/etc, " "LZVN-compressed, which the image reader does not stage)", + "honeynet_fc7_debian5": "Debian 5.0.7 i386 | 23 rows", "lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)", "pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)", "szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)", diff --git a/scripts/artifacts/linuxLogins.py b/scripts/artifacts/linuxLogins.py index 2cdbed6a..eebd31c4 100644 --- a/scripts/artifacts/linuxLogins.py +++ b/scripts/artifacts/linuxLogins.py @@ -20,7 +20,8 @@ "struct utmp " "(https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/bits/utmp.h#L58-L89, " "glibc 2.42; the same header, apart from its copyright line, is the glibc " - "2.43 one installed on the tested image), read little-endian. ut_session " + "2.43 one installed on the VM ubuntu2604_arm64_logins was taken from), read " + "little-endian. ut_session " "and ut_tv are 32-bit fields where glibc sets __WORDSIZE_TIME64_COMPAT32, " "as it does on x86 " "(https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/sysdeps/x86/bits/wordsize.h#L11), " @@ -30,10 +31,11 @@ "making 400-byte records. The file's size picks the layout; when both " "sizes or neither divide it, the layout under which more records read as " "a valid, non-empty record is used, and a file for which neither layout " - "reads better is counted in the run log and not read. The tested image had " - "400-byte " - "records; the 384-byte layout is checked only on records built for the " - "unit tests. Time (UTC) is ut_tv, seconds and microseconds since " + "reads better is counted in the run log and not read. " + "ubuntu2604_arm64_logins has 400-byte records. honeynet_fc7_debian5 (Debian " + "5.0.7 on i386, glibc 2.7) has 384-byte records, and its 257 rows equal a " + "separate decode of that layout. Time (UTC) is ut_tv, seconds and " + "microseconds since " "1970-01-01 UTC, which glibc describes as the time the entry was made " "(https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/bits/utmp.h#L72-L85); " "a ut_tv of zero, or one outside the dates the report can hold, is left " @@ -65,13 +67,20 @@ "each record within a second of the time the session was started. It held " "no DEAD_PROCESS, BOOT_TIME or RUN_LVL record, and closing each known " "session added no record, so on that release this file shows when a " - "session started and not when it ended or when the system booted.", + "session started and not when it ended or when the system booted. On " + "honeynet_fc7_debian5 the file held 257 records from 2011-01-18 08:31:29 to " + "2011-02-06 14:04:39 UTC: 100 DEAD_PROCESS, 63 INIT_PROCESS, 48 " + "LOGIN_PROCESS, 22 RUN_LVL, 16 USER_PROCESS, each for root on a tty line, " + "and 8 BOOT_TIME. IP Address was blank on every row of that image, and its " + "last record falls in the second The Sleuth Kit's istat reports as the " + "file's modification time.", "paths": ('*/var/log/wtmp', '*/var/log/wtmp.[0-9]*'), "output_types": ["html", "tsv", "timeline", "lava"], "artifact_icon": "log-in", "sample_data": { "af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)", "dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)", + "honeynet_fc7_debian5": "Debian 5.0.7 i386 | 257 rows", "lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)", "pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)", "szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)", @@ -102,9 +111,9 @@ "(https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/bits/utmp.h#L36-L45): " "ll_time is 32-bit where glibc sets __WORDSIZE_TIME64_COMPAT32 (x86, " "292-byte records) and 64-bit where it does not (AArch64, 296-byte " - "records), and the layout is chosen as in Login Records (wtmp). The " - "tested image had 296-byte records; the 292-byte layout is checked only " - "on records built for the unit tests. Last Login (UTC) is ll_time, seconds " + "records), and the layout is chosen as in Login Records (wtmp). " + "ubuntu2604_arm64_logins has 296-byte records and honeynet_fc7_debian5 " + "292-byte ones. Last Login (UTC) is ll_time, seconds " "since 1970-01-01 UTC, left blank when it is zero or outside the dates the " "report can hold, and Line and Host are ll_line and ll_host, read as the " "wtmp text fields are. Account is the name on every /etc/passwd line of the " @@ -117,13 +126,18 @@ "system's etc/passwd was not found. On ubuntu2604_arm64_logins the " "file held 1,001 records and 1 that was not empty, UID 1000 (parallels), " "whose time and host equal the latest known SSH session's, 2026-09-28 " - "06:05:54 UTC from fdb2:2c26:f4e4::1.", + "06:05:54 UTC from fdb2:2c26:f4e4::1. On honeynet_fc7_debian5 the file held " + "1,001 records and 1 that was not empty, UID 0 (root) on tty1 at 2011-02-06 " + "14:04:39 UTC, the same second as the last two USER_PROCESS records for root " + "on tty1 in that image's wtmp and as the file's modification time The Sleuth " + "Kit's istat reports.", "paths": ('*/var/log/lastlog', '*/etc/passwd'), "output_types": ["html", "tsv", "timeline", "lava"], "artifact_icon": "user-check", "sample_data": { "af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)", "dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no var/log/lastlog)", + "honeynet_fc7_debian5": "Debian 5.0.7 i386 | 1 row", "lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)", "pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)", "szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)", diff --git a/scripts/artifacts/linuxPackages.py b/scripts/artifacts/linuxPackages.py index 99ec0e40..7fcf18b5 100644 --- a/scripts/artifacts/linuxPackages.py +++ b/scripts/artifacts/linuxPackages.py @@ -63,6 +63,7 @@ "sample_data": { "af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)", "dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)", + "honeynet_fc7_debian5": "Debian 5.0.7 i386 | 0 rows (no member matches the declared paths)", "lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)", "pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)", "szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)", @@ -82,7 +83,8 @@ "notes": "Reads /var/log/dpkg.log and its numbered rotations, gzip ones included, " "one row per install, upgrade, remove, purge or disappear line in file " "order. dpkg 1.23.7, the upstream release of the dpkg 1.23.7ubuntu1 on the " - "VM the tested image was taken from, documents its log lines as a date and " + "VM ubuntu2604_arm64_triage was taken from, documents its log lines as a " + "date and " "time followed " "by startup, by status, by one of the actions install, upgrade, " "configure, trigproc, disappear, remove or purge with a package and its " @@ -96,7 +98,10 @@ "log and not reported. Time (local) is the date and time as stored: dpkg " "writes it from the local time of the machine and records no time zone " "(https://github.com/guillemj/dpkg/blob/ef4d59f5925661818484ac666014ee3e665aadcf/lib/dpkg/log.c#L64-L70), " - "so it is not converted. On ubuntu2604_arm64_triage the last line's time, " + "so it is not converted. dpkg 1.14.31, which wrote honeynet_fc7_debian5's " + "dpkg.log, stamps a line the same way (lib/log.c, " + "https://github.com/guillemj/dpkg/blob/6f4708b786579fa5fdb4d992459332c5c13c9bfb/lib/log.c#L71-L74). " + "On ubuntu2604_arm64_triage the last line's time, " "2026-09-25 11:13:11, equals dpkg.log's modification time in New York " "time, the zone its /etc/localtime names. dpkg.log and dpkg.log.1 held " "2,453 action lines, the first at 2026-04-22 08:32:52 and the last at " @@ -104,14 +109,21 @@ "14,477 status, 2,348 configure, 686 startup, 279 trigproc and 1 conffile " "lines were counted and not reported. For 601 of apt's 2,339 package " "entries on that image, dpkg.log names the package with :all where " - "history.log uses " - ":arm64.", + "history.log uses :arm64. On honeynet_fc7_debian5, whose " + "/var/lib/dpkg/status records dpkg 1.14.31, the last line's time, " + "2011-02-06 12:51:49, is the file's modification time as The Sleuth Kit's " + "istat reports it, 2011-02-06 11:51:49 UTC, in Europe/Paris time, the zone " + "its /etc/timezone names. dpkg.log held 275 action lines, the first at " + "2011-01-18 08:16:55 and the last at 2011-02-06 12:51:48: 251 install, 16 " + "upgrade, 7 remove and 1 purge; 2,185 status, 265 configure, 70 startup and " + "29 trigproc lines were counted and not reported.", "paths": ('*/var/log/dpkg.log', '*/var/log/dpkg.log.[0-9]*'), "output_types": ["html", "tsv", "lava"], "artifact_icon": "package", "sample_data": { "af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)", "dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)", + "honeynet_fc7_debian5": "Debian 5.0.7 i386 | 275 rows", "lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)", "pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)", "szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)", diff --git a/scripts/artifacts/sshKeys.py b/scripts/artifacts/sshKeys.py index 4df24d92..02d43375 100644 --- a/scripts/artifacts/sshKeys.py +++ b/scripts/artifacts/sshKeys.py @@ -46,6 +46,7 @@ "sample_data": { "af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)", "dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)", + "honeynet_fc7_debian5": "Debian 5.0.7 i386 | 0 rows (no member matches the declared paths)", "lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)", "pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)", "szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)", @@ -96,6 +97,7 @@ "sample_data": { "af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)", "dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)", + "honeynet_fc7_debian5": "Debian 5.0.7 i386 | 0 rows (root's known_hosts is empty)", "lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)", "pc_mus_001_win11": "Windows 11 22H2 build 22621 | 1 row", "szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",