Log Preservation

EasyDigital Forensics & Incident Response10-15 min

The brief

An incident is in progress and log rotation could overwrite the evidence at any moment. Preserve the current authentication log by copying it, intact, to the evidence directory /root/evidence/ so the attacker's failed-login trail survives.

What you'll do

Create the evidence directory /root/evidence
Copy /var/log/auth.log there, contents intact

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.