First page Back Continue Last page Summary Graphics
The HoneyNet Forensic Challenge --Analysis & Findings
The Givens
Standard RedHat 6.2 installation
- Installed on Nov. 4 2000
- Last rebooted on Nov. 5 2000
- Boots into runlevel 3 (no X)
System timezone set to GMT-0600 (CST)
- Later discovered time was off by -00:57:09
Notes:
When performing forensics it is always a good idea to verify the givens (even for a machine you own).
Accurate timekeeping is very important for forensics. Cannot perform event correllation between systems without it.