Skip to content

Record the Debian 5 image in the Linux artifacts #366

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abrignoni merged 1 commit into from
Sep 28, 2026
Merged

Record the Debian 5 image in the Linux artifacts #366

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion scripts/artifacts/bashHistory.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,13 +44,15 @@
"no time. On pc_mus_001_win11 a .bash_history in a Windows user profile "
"folder held 383 lines and no stamp: 368 rows, Time (UTC) blank on all of them, and 15 empty lines. "
"On the public MacBook Pro logical extraction root's .bash_history, in private/var/root and "
"System/Volumes/Data/private/var/root, held one line each and no stamp.",
"System/Volumes/Data/private/var/root, held one line each and no stamp. On honeynet_fc7_debian5 "
"root's .bash_history held 57 lines and no stamp: 57 rows, Time (UTC) blank on all of them.",
"paths": ('*/.bash_history',),
"output_types": ["html", "tsv", "lava"],
"artifact_icon": "terminal",
"sample_data": {
"af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)",
"dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)",
"honeynet_fc7_debian5": "Debian 5.0.7 i386 | 57 rows",
"lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)",
"pc_mus_001_win11": "Windows 11 22H2 build 22621 | 368 rows",
"szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",
Expand Down
6 changes: 5 additions & 1 deletion scripts/artifacts/linuxAccounts.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,14 +53,18 @@
"/usr/sbin/nologin on 41, /bin/false on 5, /bin/bash on 2 and /bin/sync "
"on 1. Other Groups was filled on 3 accounts, and for each of them "
"Primary Group and Other Groups name the same groups the id command "
"reported for that account on the running system the same day.",
"reported for that account on the running system the same day. On honeynet_fc7_debian5 "
"the file held 23 accounts: Password Field held the same value, x, on all 23, Shell was "
"/bin/sh on 17, /bin/bash on 2, /bin/false on 2, /bin/sync on 1 and /usr/sbin/nologin on "
"1, and Other Groups was filled on 1 account.",
"paths": ('*/etc/passwd', '*/etc/group'),
"output_types": ["html", "tsv", "lava"],
"artifact_icon": "users",
"sample_data": {
"af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)",
"dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (passwd and group only under private/etc, "
"LZVN-compressed, which the image reader does not stage)",
"honeynet_fc7_debian5": "Debian 5.0.7 i386 | 23 rows",
"lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)",
"pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)",
"szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",
Expand Down
34 changes: 24 additions & 10 deletions scripts/artifacts/linuxLogins.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,8 @@
"struct utmp "
"(https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/bits/utmp.h#L58-L89, "
"glibc 2.42; the same header, apart from its copyright line, is the glibc "
"2.43 one installed on the tested image), read little-endian. ut_session "
"2.43 one installed on the VM ubuntu2604_arm64_logins was taken from), read "
"little-endian. ut_session "
"and ut_tv are 32-bit fields where glibc sets __WORDSIZE_TIME64_COMPAT32, "
"as it does on x86 "
"(https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/sysdeps/x86/bits/wordsize.h#L11), "
Expand All @@ -30,10 +31,11 @@
"making 400-byte records. The file's size picks the layout; when both "
"sizes or neither divide it, the layout under which more records read as "
"a valid, non-empty record is used, and a file for which neither layout "
"reads better is counted in the run log and not read. The tested image had "
"400-byte "
"records; the 384-byte layout is checked only on records built for the "
"unit tests. Time (UTC) is ut_tv, seconds and microseconds since "
"reads better is counted in the run log and not read. "
"ubuntu2604_arm64_logins has 400-byte records. honeynet_fc7_debian5 (Debian "
"5.0.7 on i386, glibc 2.7) has 384-byte records, and its 257 rows equal a "
"separate decode of that layout. Time (UTC) is ut_tv, seconds and "
"microseconds since "
"1970-01-01 UTC, which glibc describes as the time the entry was made "
"(https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/bits/utmp.h#L72-L85); "
"a ut_tv of zero, or one outside the dates the report can hold, is left "
Expand Down Expand Up @@ -65,13 +67,20 @@
"each record within a second of the time the session was started. It held "
"no DEAD_PROCESS, BOOT_TIME or RUN_LVL record, and closing each known "
"session added no record, so on that release this file shows when a "
"session started and not when it ended or when the system booted.",
"session started and not when it ended or when the system booted. On "
"honeynet_fc7_debian5 the file held 257 records from 2011-01-18 08:31:29 to "
"2011-02-06 14:04:39 UTC: 100 DEAD_PROCESS, 63 INIT_PROCESS, 48 "
"LOGIN_PROCESS, 22 RUN_LVL, 16 USER_PROCESS, each for root on a tty line, "
"and 8 BOOT_TIME. IP Address was blank on every row of that image, and its "
"last record falls in the second The Sleuth Kit's istat reports as the "
"file's modification time.",
"paths": ('*/var/log/wtmp', '*/var/log/wtmp.[0-9]*'),
"output_types": ["html", "tsv", "timeline", "lava"],
"artifact_icon": "log-in",
"sample_data": {
"af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)",
"dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)",
"honeynet_fc7_debian5": "Debian 5.0.7 i386 | 257 rows",
"lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)",
"pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)",
"szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",
Expand Down Expand Up @@ -102,9 +111,9 @@
"(https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/bits/utmp.h#L36-L45): "
"ll_time is 32-bit where glibc sets __WORDSIZE_TIME64_COMPAT32 (x86, "
"292-byte records) and 64-bit where it does not (AArch64, 296-byte "
"records), and the layout is chosen as in Login Records (wtmp). The "
"tested image had 296-byte records; the 292-byte layout is checked only "
"on records built for the unit tests. Last Login (UTC) is ll_time, seconds "
"records), and the layout is chosen as in Login Records (wtmp). "
"ubuntu2604_arm64_logins has 296-byte records and honeynet_fc7_debian5 "
"292-byte ones. Last Login (UTC) is ll_time, seconds "
"since 1970-01-01 UTC, left blank when it is zero or outside the dates the "
"report can hold, and Line and Host are ll_line and ll_host, read as the "
"wtmp text fields are. Account is the name on every /etc/passwd line of the "
Expand All @@ -117,13 +126,18 @@
"system's etc/passwd was not found. On ubuntu2604_arm64_logins the "
"file held 1,001 records and 1 that was not empty, UID 1000 (parallels), "
"whose time and host equal the latest known SSH session's, 2026-09-28 "
"06:05:54 UTC from fdb2:2c26:f4e4::1.",
"06:05:54 UTC from fdb2:2c26:f4e4::1. On honeynet_fc7_debian5 the file held "
"1,001 records and 1 that was not empty, UID 0 (root) on tty1 at 2011-02-06 "
"14:04:39 UTC, the same second as the last two USER_PROCESS records for root "
"on tty1 in that image's wtmp and as the file's modification time The Sleuth "
"Kit's istat reports.",
"paths": ('*/var/log/lastlog', '*/etc/passwd'),
"output_types": ["html", "tsv", "timeline", "lava"],
"artifact_icon": "user-check",
"sample_data": {
"af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)",
"dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no var/log/lastlog)",
"honeynet_fc7_debian5": "Debian 5.0.7 i386 | 1 row",
"lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)",
"pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)",
"szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",
Expand Down
20 changes: 16 additions & 4 deletions scripts/artifacts/linuxPackages.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@
"sample_data": {
"af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)",
"dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)",
"honeynet_fc7_debian5": "Debian 5.0.7 i386 | 0 rows (no member matches the declared paths)",
"lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)",
"pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)",
"szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",
Expand All @@ -82,7 +83,8 @@
"notes": "Reads /var/log/dpkg.log and its numbered rotations, gzip ones included, "
"one row per install, upgrade, remove, purge or disappear line in file "
"order. dpkg 1.23.7, the upstream release of the dpkg 1.23.7ubuntu1 on the "
"VM the tested image was taken from, documents its log lines as a date and "
"VM ubuntu2604_arm64_triage was taken from, documents its log lines as a "
"date and "
"time followed "
"by startup, by status, by one of the actions install, upgrade, "
"configure, trigproc, disappear, remove or purge with a package and its "
Expand All @@ -96,22 +98,32 @@
"log and not reported. Time (local) is the date and time as stored: dpkg "
"writes it from the local time of the machine and records no time zone "
"(https://github.com/guillemj/dpkg/blob/ef4d59f5925661818484ac666014ee3e665aadcf/lib/dpkg/log.c#L64-L70), "
"so it is not converted. On ubuntu2604_arm64_triage the last line's time, "
"so it is not converted. dpkg 1.14.31, which wrote honeynet_fc7_debian5's "
"dpkg.log, stamps a line the same way (lib/log.c, "
"https://github.com/guillemj/dpkg/blob/6f4708b786579fa5fdb4d992459332c5c13c9bfb/lib/log.c#L71-L74). "
"On ubuntu2604_arm64_triage the last line's time, "
"2026-09-25 11:13:11, equals dpkg.log's modification time in New York "
"time, the zone its /etc/localtime names. dpkg.log and dpkg.log.1 held "
"2,453 action lines, the first at 2026-04-22 08:32:52 and the last at "
"2026-09-25 11:13:11: 1,635 install, 713 upgrade, 84 remove and 21 purge; "
"14,477 status, 2,348 configure, 686 startup, 279 trigproc and 1 conffile "
"lines were counted and not reported. For 601 of apt's 2,339 package "
"entries on that image, dpkg.log names the package with :all where "
"history.log uses "
":arm64.",
"history.log uses :arm64. On honeynet_fc7_debian5, whose "
"/var/lib/dpkg/status records dpkg 1.14.31, the last line's time, "
"2011-02-06 12:51:49, is the file's modification time as The Sleuth Kit's "
"istat reports it, 2011-02-06 11:51:49 UTC, in Europe/Paris time, the zone "
"its /etc/timezone names. dpkg.log held 275 action lines, the first at "
"2011-01-18 08:16:55 and the last at 2011-02-06 12:51:48: 251 install, 16 "
"upgrade, 7 remove and 1 purge; 2,185 status, 265 configure, 70 startup and "
"29 trigproc lines were counted and not reported.",
"paths": ('*/var/log/dpkg.log', '*/var/log/dpkg.log.[0-9]*'),
"output_types": ["html", "tsv", "lava"],
"artifact_icon": "package",
"sample_data": {
"af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)",
"dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)",
"honeynet_fc7_debian5": "Debian 5.0.7 i386 | 275 rows",
"lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)",
"pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)",
"szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",
Expand Down
2 changes: 2 additions & 0 deletions scripts/artifacts/sshKeys.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@
"sample_data": {
"af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)",
"dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)",
"honeynet_fc7_debian5": "Debian 5.0.7 i386 | 0 rows (no member matches the declared paths)",
"lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)",
"pc_mus_001_win11": "Windows 11 22H2 build 22621 | 0 rows (no member matches the declared paths)",
"szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",
Expand Down Expand Up @@ -96,6 +97,7 @@
"sample_data": {
"af_case2_win10": "Windows 10 1809 build 17763 | 0 rows (no member matches the declared paths)",
"dleapp_macos_bigsur": "macOS 11.2.1 build 20D74 | 0 rows (no member matches the declared paths)",
"honeynet_fc7_debian5": "Debian 5.0.7 i386 | 0 rows (root's known_hosts is empty)",
"lonewolf_win10": "Windows 10 Education build 16299 | 0 rows (no member matches the declared paths)",
"pc_mus_001_win11": "Windows 11 22H2 build 22621 | 1 row",
"szechuan_win10": "Windows 10 2004 build 19041 | 0 rows (no member matches the declared paths)",
Expand Down
Loading