Lion Cipher Lab
Rebuild a Linux package timeline from dpkg and apt logs
- Digital Forensics & IR (DFIR)
- Intermediate
- ~70 min
- Free · no account required
Why it matters
When an intruder gets sudo on a Linux server, one of the first things they often do is install tools: a scanner, a relay, a compiler, a packet sniffer. Then, if they are careful, they remove them. On Debian and Ubuntu every one of those moves passes through the package manager, and the package manager keeps its own diary in places most attackers never think to clean: dpkg writes a line for every install, upgrade and removal, apt writes a block saying who asked and what command they typed, and the package database remembers things even after the logs are gone. Reading that diary well turns…
What you'll learn
- Reading /var/log/dpkg.log action and status lines (install, upgrade, remove, purge, half-configured, config-files)
- Reading apt's /var/log/apt/history.log transaction blocks: Start-Date, Commandline, Requested-By, Install with (automatic), End-Date
- Finding last month's evidence in rotated logs, and knowing why dpkg.log.1 is plain text while history.log.1 is gzipped
- Merging dpkg, apt, auth.log and the dpkg status database into one attributed package timeline with a stdlib Python script
- Spotting a package installed with dpkg -i (in dpkg.log, absent from apt history) and a removal that left config files behind
- Stating what the package trail cannot see: pip, snap, manual builds, deleted logs, and timestamps with no time zone
Steps in this lab
- What a package timeline is, and why an investigator wants one
- The four places a package change leaves a mark
- Where last month went: rotation, and why one file is gzipped and the other is not
- Build the evidence folder
- Read it by hand first -- and meet the two-space trap
- Merge every source into one attributed timeline
- Measure what each source alone would have told you
- Attribution: what Requested-By really is, and where it goes blank
- If the logs are gone: what the package database still remembers
- What the package trail cannot see
- Optional: read your own machine's package diary (read-only)
- When to reach for this, and how a pro does it better