-1
votes
1answer
59 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
4
votes
2answers
2k views

How to determine which file/inode occupies a given sector

I received messages in /var/log/kern.log that indicate drive failure. The messages occured while copying my $HOME between drives (ext4 -> ext3): [ 5733.186033] sd 4:0:0:0: [sdb] Unhandled sense code ...
3
votes
3answers
2k views

Foremost custom file type not accepted by -t argument

I'm trying to recover a deleted file on an ext3 file system using the foremost utility. The file I want to recover is a hpp C++ source code file. However, foremost does not automatically support the ...
7
votes
1answer
2k views

Forensic Analysis of the OOM-Killer

Ubuntu's Out-Of-Memory Killer wreaked havoc on my server, quietly assassinating my applications, sendmail, apache and others. I've managed to learn what the OOM Killer is, and about its "badness" ...
2
votes
3answers
437 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
4answers
777 views

Linux backdoors I should be wary of

I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...