IX. Advanced (Beginner) Forensics

The following sections are more advanced and detailed. New tools are introduced to help round out some of your knowledge and provide a more solid footing on the capabilities of the Linux command line. The topics are still at the beginner level, but youshould be at least somewhat comfortable with the command line before tackling the exercises. Although I’ve included the commands and much of the output for those who are reading this without the benefit of a Linux box nearby, it is important that you follow along on your own system as we go through the practical exercises. Typing at the keyboard and experimentation is the only way to learn.