Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's for an assignment to practice a bit of forensics. We're given VirtualBox images and told to figure out if a certain user messed up the ssh config.

I mounted the image as read-only, and found that the user's .bash_history reads:

rm .bash_history

I'm pretty stuck. Does anyone have any advice?

I'm currently trying (unsuccessfully) to figure out the extcarve tool, and what its output files are.

share|improve this question
How hard is the class? Do they expect you to be able to parse raw ext2/3/4 data yet, or are they still at the easy things (like, who is the owner of the sshd config file) ? – Hennes Apr 4 '13 at 20:20
Programs like extcarve and Bulk Extractor were not-too-subtly hinted at... – user1399747 Apr 5 '13 at 4:42
up vote 1 down vote accepted

There might be a simpler way to do this, but this what I would attempt with a physical machine:

  1. Add a second drive.

  2. Boot from an Ubuntu Live CD image (preferably 12.04 LTS).

  3. Open a terminal and install PhotoRec by executing

    sudo apt-get install testdisk
  4. Mount the disk you want to recover to.

  5. Start PhotoRec:

    sudo photorec
  6. Select the appropriate disk.

  7. Unselect everything except txt in File Opt.

  8. Select the appropriate partition.

  9. Select the appropriate filesystem.

  10. Free should suffice. You can retry with Whole if it doesn't.

  11. Choose a destination for the files on the mounted disk.

  12. Wait for the process to finish.

  13. Search the output with grep:

    grep -R ssh_config /media/<mountpoint>

Bash's history file is unlikely to become fragmented, so – unless the file as already been overwritten – this should work.

Keep in mind that somebody that knows what he's doing won't get caught by this. It's easy to prevent command from ever getting saved to the history file by setting HISTCONTROL=ignorespace and prepending the commands with a space or just killing the terminal without exiting properly.

share|improve this answer
Good advice. Unfortunately, there was nothing useful containing "ssh_config", only .h and .java files. I'll try searching for that user's name next I guess. Otherwise, I'm a bit stumped. – user1399747 Apr 5 '13 at 4:46

This is one of those times where you are forced to learn a lesson after the fact.

.bash_history is a rather weak way of making sure your users are not being naughty, however, you can secure .bash_history by setting chattr flags.

share|improve this answer
You would need to set the append only flag in advance though. And hope the use uses bash as a shell instead of something else. – Hennes Apr 4 '13 at 20:19
Yep, I felt that saying "learn a lesson after the fact" covered that concept. – jnovack Apr 4 '13 at 20:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .