System, method and program product for automatically collecting state information for computer system intrusion analysis

BACKGROUND OF THE INVENTION

[0001] 1. Field of the Invention

[0002] The present invention generally relates to a system, method and program product for automatically collecting state information for computer system intrusion analysis. Specifically, the present invention allows state information to be automatically collected from a computer system regardless of the platform operating thereon.

[0003] 2. Background Art

[0004] Computer system intrusion (e.g., hacking) has become a serious problem for governments and businesses. Specifically, a hacker can gain unauthorized access to a network by establishing a connection to a server (i.e., host). Once connected, the hacker can severely disrupt or crash the network. Each year, billions of dollars are lost to such hacker intrusions.

[0005] When hacker intrusion occurs, it is essential to be able to discern how the intrusion occurred and to what degree the network was affected. To this extent, state information regarding the server and its network environment is essential. State information relates to the condition of being of a system, and is subject to change (e.g., is dynamic). In general, the state of a system (e.g., a server) is maintained in various file locations as well as in volatile memory such as Random Access Memory (RAM). State information typically includes information such as network interface configuration, active environment variables, routing tables, active network services, etc. In the event of intrusion, state information is usually affected in a manner that can indicate the details of the intrusion. Accordingly, state information can be extremely valuable for intrusion analysis.

[0006] Heretofore, the collection of state information has been a time-consuming and inaccurate process as no tools currently exist to automatically collect the information. In contrast, existing tools typically focus on recovering non-state information such as files (e.g., memorandums, electronic mail messages, etc.) from a computer system's hard drive and/or file slack space. While such information may help show wrongdoing by an authorized user of the network, it provides little use in the event of intrusion. If state information is desired, it must be manually recovered by an intrusion investigator or a system administrator. Unfortunately, the manual recovery of state information yields mixed results. For example, different administrators might recover different types of information. Moreover, as platforms (operating systems) change, the manner in which state information is stored and retrieved may change as well. For example, the manner in which state information is recovered a computer system operating with UNIX version “A” might differ from the manner in which it is recovered from a computer system operating with UNIX version “B.” This makes collection of the necessary state information extremely difficult.

[0007] In view of the foregoing, there exists a need for a tool for automatically collecting state information for computer system intrusion analysis. In addition, a need exists for such a tool to be able to identify the type of a platform operating on a computer system so that the information can be more readily recovered. A further need exists for a tool that uses the utilities of the identified platform to locate the sought information.

SUMMARY OF THE INVENTION

[0008] The present invention relates to a system, method and program product for automatically collecting state information for computer system intrusion analysis. Specifically, under the present invention, a tool is loaded onto a hacked (intruded) computer system. The tool will first identify the platform operating on the system. Once identified, the tool will utilize the utilities of the platform to recover, protect and output the state information. The state information collected under the present invention typically includes: (1) computer information pertaining to the intruded computer system itself; (2) network information pertaining to the network in which the computer system is operating; (3) information pertaining to network services and the files associated with those services; (4) process information pertaining to processes currently running on the computer system; (5) trust information pertaining to trusts extended by the computer system over the network; and (6) log files information.

[0009] According to a first aspect of the present invention, a system for automatically collecting state information for computer system intrusion analysis, is provided. The system comprises: (1) a platform identification system for automatically identifying a type of a platform loaded on a computer system; and (2) a state system for automatically collecting state information pertaining to a state of the computer system, wherein the state information is located with utilities of the identified platform.

[0010] According to a second aspect of the present invention, a method for automatically collecting state information for computer system intrusion analysis is provided. The method comprises the steps of: (1) identifying a type of a platform loaded on a computer system; (2) locating state information pertaining to a state of the computer system using utilities of the identified platform; and (3) automatically collecting the located state information from the computer system.

[0011] According to a third aspect of the present invention, a program product stored on a recordable medium for automatically collecting state information for computer system intrusion analysis is provided. When executed, the program product comprises: (1) program code for automatically identifying a type of a platform loaded on a computer system; and (2) program code for automatically collecting state information pertaining to a state of the computer system, wherein the state information is located with utilities of the identified platform.

[0012] Therefore, the present invention provides a system, method and program product for automatically collecting state information for computer system intrusion analysis.

BRIEF DESCRIPTION OF THE DRAWINGS

[0013] These and other features of this invention will be more readily understood from the following detailed description of the various aspects of the invention taken in conjunction with the accompanying drawings in which:

[0014]FIG. 1 depicts a computer system having a collection system according to the present invention.

[0015]FIG. 2 depicts the state system of FIG. 1 in greater detail.

[0016]FIG. 3 depicts a process flow diagram according to the present invention.

[0017] The drawings are merely schematic representations, not intended to portray specific parameters of the invention. The drawings are intended to depict only typical embodiments of the invention, and therefore should not be considered as limiting the scope of the invention. In the drawings, like numbering represents like elements.

DETAILED DESCRIPTION OF THE INVENTION

[0018] As indicated above, the present invention provides automatic collection of state information for computer system intrusion analysis. As indicated above, the collection of state information to date has been performed manually. That is, an investigator or system administrator must manually locate and collect the state information. This is often an inconsistent process as different individuals might collect different types of information. Moreover, as platforms vary, the manner in which the information is stored might vary as well. The present invention therefore, provides a system, method and program product for automatically collecting state information regardless of the platform operating on the system under investigation. As used herein, the term “state” is intended to refer to the condition of being of a system such as a network server. The state of a system can be determined by retrieving various pieces of state information from volatile memory and/or configuration log files. Such information provides valuable insight when conducting intrusion analysis.

[0019] Referring now to FIG. 1, a typical implementation of the present invention is shown in detail. In general, the present invention is used to collect state information when a network <b>10</b> is intruded. As shown in FIG. 1, network <b>10</b> is hosted by server <b>12</b> and includes workstations <b>30</b> and <b>32</b> and remote system <b>11</b>. Hacker <b>28</b> can intrude into network <b>10</b> by establishing an (unauthorized) connection with server <b>12</b> through remote system <b>26</b>. Upon intrusion, investigator <b>34</b> will perform intrusion analysis by collecting state information collected from server <b>12</b>. As further shown, remote systems <b>11</b> and <b>26</b>, workstations <b>30</b> and <b>32</b>, <b>20</b> and investigator <b>34</b> communicate with server <b>12</b> via communications links <b>36</b>. Communications links <b>36</b> are intended to represent any possible method of communicating with server <b>12</b>. For example workstations <b>30</b> and <b>32</b> can communicate directly as a terminal connected to server <b>12</b>, or remotely in a client-server environment. In the case of the latter, the client and server may be connected via the Internet, wide area networks (WAN), local area networks (LAN) or other private networks. The client and server may utilize conventional network connectivity, such as Token Ring, Ethernet, or other conventional communications standards. Remote systems <b>11</b> and <b>26</b> are intended to be representative of systems connected to server <b>12</b> in a client-server environment via, for example, the Internet. In this case, connectivity could be provided by conventional TCP/IP sockets-based protocol, and remote systems <b>11</b> and <b>26</b> would utilize an Internet service provider to establish connectivity to server <b>12</b>. Investigator <b>34</b> can communicate with server <b>12</b> in any known manner (e.g., directly, via workstation <b>30</b>, via remote system <b>11</b>, etc.). It should be understood that the depiction of FIG. 1 is intended to be exemplary only, and that the present invention could be implemented with any network variation.

[0020] As shown, server <b>12</b> generally comprises memory <b>14</b>, central processing unit (CPU) <b>16</b>, bus <b>18</b>, input/output (I/O) interfaces <b>20</b>, external devices/resources <b>22</b> and database <b>24</b>. Memory <b>14</b> may comprise any known type of data storage and/or transmission media, including magnetic media, optical media, random access memory (RAM), read-only memory (ROM), a data cache, a data object, etc. Moreover, memory <b>14</b> may reside at a single physical location, comprising one or more types of data storage, or be distributed across a plurality of physical systems in various forms. CPU <b>16</b> may likewise comprise a single processing unit, or be distributed across one or more processing units in one or more locations, e.g., on a client and server.

[0021] I/O interfaces <b>20</b> may comprise any system for exchanging information to/from an external source. External devices <b>22</b> may comprise any known type of external device, including speakers, a CRT, LED screen, hand-held device, keyboard, mouse, voice recognition system, speech output system, printer, monitor, facsimile, pager, etc. Bus <b>18</b> provides a communication link between each of the components in the server <b>12</b> and likewise may comprise any known type of transmission link, including electrical, optical, wireless, etc. Although not shown, additional components, such as cache memory, communication systems, system software, etc., may be incorporated into server <b>12</b>.

[0022] Database <b>24</b> may provide storage for information necessary to carry out the present invention such as collected state information, etc. As such, database <b>24</b> may include one or more storage devices, such as a magnetic disk drive or an optical disk drive. In another embodiment, database <b>24</b> includes data distributed across, for example, a local area network (LAN), wide area network (WAN) or a storage area network (SAN) (not shown). Database <b>24</b> may also be configured in such a way that one of ordinary skill in the art may interpret it to include one or more storage devices.

[0023] It should be understood that although not shown in FIG. 1, remote systems <b>11</b> and <b>26</b>, and workstations <b>30</b> and <b>32</b> typically include computer components (e.g., CPU, memory, etc.) similar to server <b>12</b>. Such components have not been shown for brevity purposes.

[0024] Stored in memory <b>14</b> (as a program product) is collection system <b>38</b>, which utilizes utilities <b>35</b> of platform <b>37</b> to locate and/or collect general and state information from server <b>12</b>. As depicted, collection system <b>38</b> includes platform system <b>40</b>, general information system <b>42</b>, state system <b>44</b>, security system <b>46</b>, and output system <b>48</b>. In general, collection system <b>38</b> will identify the type of platform <b>37</b> that is operating on server <b>12</b>. Once identified, utilities <b>35</b> will be used to locate and/or collect desired state information. Once collected, the state information can be stored in database <b>24</b> and/or outputted to investigator <b>34</b>. Specifically, when network <b>10</b> is intruded, collection system <b>38</b> can be executed. Upon execution, platform system <b>40</b> will first identify the type of platform <b>37</b> operating thereon. As indicated above, state information may be stored differently depending on the type or version of platform <b>37</b> operating on server <b>12</b>. Accordingly, platform system <b>40</b> will identify the precise platform <b>37</b> (e.g., UNIX version “A,” Windows XP, etc.) that is operating. Once identified, all information can be located and collected using utilities <b>35</b>. Specifically, collection system <b>38</b> (or the sub-systems thereof) is programmed to know which utilities to use to locate each piece of desired information for each different type of platform. That is, collection system <b>38</b> is programmed to know where to look for each piece of information, or where to find out how to locate a piece of information. Thus, whether the platform on server <b>12</b> is Windows XP or UNIX, the same information will be collected.

[0025] Once the type of platform <b>37</b> has been identified, security system <b>36</b> will secure the information collection process. This can be accomplished, for example, by implementing a race condition in the creation of a temporary file to protect the information as it is being collected. Such protection will guard against, among other things, simlink attacks against the temporary files created during information collection.

[0026] Once the collection process has been secured, general information system <b>42</b> will automatically collect general (header) information from server <b>12</b>. Such information typically includes, among other things, the name of server <b>12</b>, the type of server <b>12</b>, the date as kept by server <b>12</b>, etc.

[0027] Once general information has been collected, state system <b>44</b> will automatically collect the state information. In general, state information collected under the present invention includes network information, trust information, computer (server <b>12</b>) information, process information and log file information. Referring now to FIG. 2, state system <b>44</b> is shown in greater detail. Network system <b>50</b> will automatically collect information pertaining to network <b>10</b> in which server <b>12</b> is operating. Network information typically includes information pertaining to, among other things, network interface configurations, network routing information, open network ports, available services, processes bound to the services, etc. The collected network information may identify a point of intrusion as well as any changes made to the network resulting from the intrusion.

[0028] Once network information has been collected, trust system <b>52</b> will automatically collect information pertaining to any trusts extended by server <b>12</b> over network <b>10</b>. Specifically, when a trust is established with server <b>12</b>, a connection is created through which communication can easily pass. Such trusts can be an easy point of intrusion for hacker <b>28</b>.

[0029] After the trust information has been collected, computer information system <b>54</b> will automatically collect computer information pertaining to server <b>12</b> itself. Computer information generally includes information pertaining to, among other things, common intrusion indicators (e.g., .. (dot-dot) directories), set user identification (UID) and set group identification (GID) files (e.g., to identify processes running with high privileges than other processes), I-node values (e.g., to identify files that were recently changed), configured file systems (e.g., to identify what file systems are configured and open), users currently logged on, loaded kernel modules (e.g., to determine if a kernel module is loaded that should not be loaded), how many reboots have occurred, and password files (e.g., to identify any passwords that have been recently used).

[0030] After computer information has been collected, process system <b>56</b> will automatically collect process information. In general, process information includes information pertaining to, among other things, scheduled current jobs, process lists, environment variables, and open files and the process using them. Collecting process information can give investigator <b>34</b> a good idea of how the network and/or server <b>12</b> were affected by the intrusion. Finally, once process information has been collected, log file system <b>58</b> will automatically collect log file information from the hard drive of server <b>12</b>. Such information should pertain to, among other things, active log files, and parsed log files.

[0031] As indicated above, all information location and/or collection under the present invention (header and state) are done so based on the platform type operating on server <b>12</b> (e.g., via utilities <b>35</b>). Thus, either the individual sub-systems will be informed where to obtain the information, or they will be informed how to find out where to obtain the information. It should be appreciated that separate sub-systems have been shown in FIGS. 1 and 2 for illustrative purposes only and other variations could be implemented. For example, state system <b>44</b> could be comprised of a single sub-system that collects all state information.

[0032] Referring back to FIG. 1, once all information has been collected it can be secured for output to investigator <b>34</b>. In general, security is provided by security system <b>46</b> in the form of cryptography. For example, the outputted information can be hashed and cryptographically summed. However, it should be understood that security of the output can be provided in any known manner.

[0033] Referring now to FIG. 3 a process flow chart according to the present invention is shown in detail. As depicted, upon execution, a platform will be identified <b>100</b>. Once identified, security system <b>46</b> will secure the collection process <b>102</b>. As indicated above, this can be accomplished through a race condition in the creation of a temporary file. Once protection of the information during collection is provided, general (header) information will be automatically collected <b>104</b> followed by network information <b>106</b>. After network information has been collected, trust information will be collected <b>108</b> so that any trusts extended by server <b>12</b> over network <b>10</b> can be evaluated. Then, computer information will be collected <b>110</b> pertaining to server <b>12</b> itself. Once collected, process information will be collected <b>112</b> and all log file information will be gathered <b>114</b>. Then, all collected information will be cryptographically secured and outputted to investigator <b>116</b>.

[0034] It should be understood that a particular order for collecting information has been set forth herein for illustrative purposes only and other variations could be implemented. For example, computer system information could be collected prior to network information, etc.

[0035] It is understood that the present invention can be realized in hardware, software, or a combination of hardware and software. Any kind of computer/server system(s)—or other apparatus adapted for carrying out the methods described herein—is suited. A typical combination of hardware and software could be a general purpose computer system with a computer program that, when loaded and executed, controls server <b>12</b> such that it carries out the methods described herein. Alternatively, a specific use computer, containing specialized hardware for carrying out one or more of the functional tasks of the invention could be utilized. The present invention can also be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which—when loaded in a computer system—is able to carry out these methods. Computer program, software program, program, or software, in the present context mean any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following: (a) conversion to another language, code or notation; and/or (b) reproduction in a different material form.

EXAMPLE

[0036] Shown below is exemplary code for the present invention: <tables id="TABLE-US-00001" num="1"><table frame="none" colsep="0" rowsep="0" pgwide="1"><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><thead><row><entry /><entry /></row><row><entry /><entry namest="OFFSET" nameend="1" align="center" rowsep="1" /></row></thead><tbody valign="top"><row><entry /><entry>umask 077</entry></row><row><entry /><entry>PATH=/bin:/sbin:/usr/bin:/usr/sbin</entry></row><row><entry /><entry>export PATH</entry></row><row><entry /><entry>system=‘uname’</entry></row><row><entry /><entry>exec &gt; forensics.txt 2&gt;/dev/null</entry></row><row><entry /><entry>num=$$</entry></row><row><entry /><entry>prog=‘basename $0’</entry></row><row><entry /><entry>if [ -z “$TMPDIR” ]</entry></row><row><entry /><entry>then</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>TMPDIR=/tmp/$prog</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>else</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>TMPDR=$TMPDIR/$prog</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>fi</entry></row><row><entry /><entry>export TMPDIR</entry></row><row><entry /><entry>if[ !-w “‘dirname $TMPDTR’” ]</entry></row><row><entry /><entry>then</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “$prog: could not write to directory\“‘dirname $TMPDIR’\“” &gt;&amp;2</entry></row><row><entry /><entry>exit 1</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>fi</entry></row><row><entry /><entry>while:</entry></row><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>if mkdir -m 0700 $TMPDIR.$num 2&gt;/dev/null</entry></row><row><entry /><entry>then</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="42PT" align="left" /><colspec colname="1" colwidth="217PT" align="left" /><tbody valign="top"><row><entry /><entry>break</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>fi</entry></row><row><entry /><entry>num=‘expr’ $num + 1’</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>done</entry></row><row><entry /><entry>TMPDIR=$TMPDTR.$num</entry></row><row><entry /><entry>cleanup() {</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>cd /</entry></row><row><entry /><entry>/bin/rm -rf $TMPDIR 2&gt;/dev/null</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>}</entry></row><row><entry /><entry>trap ‘rc=$?; trap “” 0; cleanup; exit $rc’1 2 3 15</entry></row><row><entry /><entry>trap ‘cleanup; exit’ 0</entry></row><row><entry /><entry>filelist=$TMPDTR/filelist.tmp</entry></row><row><entry /><entry>1slist=$TMPDIR/1slist.tmp</entry></row><row><entry /><entry>wtmpfile=$TMPDIR/wtmpfile</entry></row><row><entry /><entry>echo “” &gt;/dev/tty</entry></row><row><entry /><entry>echo “IBM Global Services, Managed Security Services Delivery” &gt;/dev/tty</entry></row><row><entry /><entry>echo “For questions contact: ccalvert@us.ibm.com”&gt;/dev/tty</entry></row><row><entry /><entry>echo “” &gt;/dev/tty</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“**************************************************************”</entry></row><row><entry /><entry>&gt;/dev/tty</entry></row><row><entry /><entry>echo “* This script captures a forensic snapshot of a potentially *” &gt;/dev/tty</entry></row><row><entry /><entry>echo “* compromised UNIX system. This script outputs a fils name *” &gt;/dev/tty</entry></row><row><entry /><entry>echo “* forensics.tar.Z into the directory from which it was run. *” &gt;/dev/tty</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="3"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="161PT" align="left" /><colspec colname="2" colwidth="84PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “* This script must be run as root.</entry><entry>*” &gt;/dev/tty</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>echo</entry></row><row><entry /><entry>“**************************************************************”</entry></row><row><entry /><entry>&gt;/dev/tty</entry></row><row><entry /><entry>echo “” &gt;/dev/tty</entry></row><row><entry /><entry>echo “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “Gathering general information.” &gt;/dev/tty</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>cat &lt;&lt;eof</entry></row><row><entry /><entry>System Name: ‘hostname’</entry></row><row><entry /><entry>Date: ‘date’</entry></row><row><entry /><entry>System Type: ‘uname -a’</entry></row><row><entry /><entry>Uptime: ‘uptime’</entry></row><row><entry /><entry>eof</entry></row><row><entry /><entry>echo “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “Gathering network information.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “#############################################”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="4"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="42PT" align="left" /><colspec colname="2" colwidth="84PT" align="left" /><colspec colname="3" colwidth="119PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#</entry><entry>Network Information</entry><entry>#”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#############################################”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “The network configuration for each interface is.”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>*****************************************************************</entry></row><row><entry /><entry>*******“</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>ifconfig -a</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This is the network routing information:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>*****************************************************************</entry></row><row><entry /><entry>*******“</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>netstat -rn</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This is a netstat listing of open network connections:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>netstat -tul</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This is the 1sof list of open network connections:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>if [ -x /usr/sbin/1sof] ; then</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>1sof -1i</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>else</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “1sof is not installed on this system.”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>fi</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This captures any .rhosts files and the hosts.equiv: ”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>1s -1/etc/hosts.equiv</entry></row><row><entry /><entry>cat/etc/hosts.equiv</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>for i in ‘cut -f 6 -d “:” /etc/passwd|sort -u’</entry></row><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>1s -1 $i/.rhosts</entry></row><row><entry /><entry>cat $i/.rhosts</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>done</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “Gathering system information.” &gt;/dev/tty</entry></row><row><entry /><entry>echo“”</entry></row><row><entry /><entry>echo “#############################################”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="4"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="42PT" align="left" /><colspec colname="2" colwidth="84PT" align="left" /><colspec colname="3" colwidth="119PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#</entry><entry>System Information</entry><entry>#”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#############################################”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “.” &gt;/dev/tty</entry></row><row><entry /><entry># To Do: Parse mount for local file systems and then use the xdev option to stay</entry></row><row><entry /><entry>on the system</entry></row><row><entry /><entry>#This creates temp files with all the stuff we need to find.</entry></row><row><entry /><entry>echo “Creating file list for searching.” &gt;/dev/tty</entry></row><row><entry /><entry>find /\( -name “..*” -o -perm -4000 -o -perm -2000 -o -mtime -5 \) &gt; $filelist</entry></row><row><entry /><entry>xargs 1s -dal &lt; $filelist &gt; $1slist</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “Find all suspicious hidden directories and files on the system:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>fgrep ‘..’ $1slist</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.”&gt;/dev/tty</entry></row><row><entry /><entry>echo “Find all the suid and sgid files on the system:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>grep [r-][w-]s $1slist</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “Find all files with modify times in the last 5 days:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>while read i; do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>find $i -mtime -5 -1s</entry></row><row><entry /><entry>done &lt; $filelist|grep -v /proc/\*</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “All local filesystems are listed below:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>case “$system” in</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="3"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="42PT" align="left" /><colspec colname="2" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>Linux)</entry><entry>df-al ;;</entry></row><row><entry /><entry>SunOS)</entry><entry>df-al ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>OpenBSD) df-hl ;;</entry></row><row><entry /><entry>AIX) df ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>esac</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “The following people are currently logged in:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>who</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>w</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This lists the loaded kernel modules.”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>case “$system” in</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>Linux) 1smod ;;</entry></row><row><entry /><entry>SunOS) echo “LKM command unknown” ;;</entry></row><row><entry /><entry>OpenBSD) modstat ;;</entry></row><row><entry /><entry>AIX) sc1s ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>esac</entry></row><row><entry /><entry>echo ”“</entry></row><row><entry /><entry>echo ”“</entry></row><row><entry /><entry>echo -n “.” &gt;/devltty</entry></row><row><entry /><entry>echo “This is a record of logins, reboots and runlevel changes:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>last</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This is the /etc/passwd file:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>cat /etc/passwd</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This is the record of old wtmp files:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>case “$system” in</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>Linux) for a in /var/log/wtmp*.gz</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="98PT" align="left" /><colspec colname="1" colwidth="161PT" align="left" /><tbody valign="top"><row><entry /><entry>gunzip -c $a &gt; $wtmpfile</entry></row><row><entry /><entry>last -f$wtmpfile</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>done ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>OpenBSD) for a in /var/log/wtmp.*.gz</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="98PT" align="left" /><colspec colname="1" colwidth="161PT" align="left" /><tbody valign="top"><row><entry /><entry>gunzip -c $a &gt; $wtmpfile</entry></row><row><entry /><entry>last -f$wtmpflle</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>done ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>SunOS) for a in /var/admlwtmp*.gz</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="98PT" align="left" /><colspec colname="1" colwidth="161PT" align="left" /><tbody valign="top"><row><entry /><entry>gunzip -c $a &gt; $wtmpfile</entry></row><row><entry /><entry>last -f$wtmpfile</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>done ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>AIX) for a in /var/adm/wtmp*.gz</entry></row><row><entry /><entry># does AIX zip its old files</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="98PT" align="left" /><colspec colname="1" colwidth="161PT" align="left" /><tbody valign="top"><row><entry /><entry>gunzip -c $a &gt; $wtmpfile</entry></row><row><entry /><entry>last -f$wtmp file</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>done ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>esac</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “Gathering process information.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “#############################################”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="4"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="42PT" align="left" /><colspec colname="2" colwidth="84PT" align="left" /><colspec colname="3" colwidth="119PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#</entry><entry>Process Information</entry><entry>#”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#############################################”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This shows the cron jobs:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>case “$system” in</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="3"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="42PT" align="left" /><colspec colname="2" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>Linux)</entry><entry>for FILE in /var/spool/cron/*</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>do 1s -1 $FILE</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="84PT" align="left" /><colspec colname="1" colwidth="175PT" align="left" /><tbody valign="top"><row><entry /><entry>cat $FILE</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>1s -1/etc/cron*</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>done ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>SunOS) for FILE in /var/spool/cron/crontabs/*</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>do 1s -1 $FILE</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="84PT" align="left" /><colspec colname="1" colwidth="175PT" align="left" /><tbody valign="top"><row><entry /><entry>cat $FILE</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>done ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>OpenBSD) for FILE in /var/cron/tabs/*</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>do 1s -1 $FILE</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="84PT" align="left" /><colspec colname="1" colwidth="175PT" align="left" /><tbody valign="top"><row><entry /><entry>cat $FILE</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>done ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>AIX) for FILE in /var/spool/cron/crontabs/*</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>do 1s -1 $FILE</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="84PT" align="left" /><colspec colname="1" colwidth="175PT" align="left" /><tbody valign="top"><row><entry /><entry>cat $FILE</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="70PT" align="left" /><colspec colname="1" colwidth="189PT" align="left" /><tbody valign="top"><row><entry /><entry>done ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>esac</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This is a list of running processes:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>case “$system” in</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>Linux) ps -ef ;;</entry></row><row><entry /><entry>SunOS) ps -ef ;;</entry></row><row><entry /><entry>OpenBSD) ps auxw ;;</entry></row><row><entry /><entry>AIX) ps -ef ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>esac</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This dumps the current environment:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>case “$system” in</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>Linux) ps gxeww ;;</entry></row><row><entry /><entry>SunOS) env ;;</entry></row><row><entry /><entry>OpenBSD) ps gxeww ;;</entry></row><row><entry /><entry>AIX) ps gxeww ;;</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>esac</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This is the list of open files:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>if [ -x /usr/sbin/1sof] ; then</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>1sof</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>else</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “1sof is not installed on this system.”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>fi</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “Gathering log file information.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “#############################################”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="4"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="42PT" align="left" /><colspec colname="2" colwidth="84PT" align="left" /><colspec colname="3" colwidth="119PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#</entry><entry>Log Files</entry><entry>#”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#############################################”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.”&gt;/dev/tty</entry></row><row><entry /><entry>echo “This is the conglomeration of all history files on the system:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>for i in ‘cut -f 6 -d “:” /etc/passwd|sort -u’</entry></row><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>echo $i</entry></row><row><entry /><entry>1s -1 “$i”/.*history</entry></row><row><entry /><entry>echo</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>cat “$i”/*history</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>done</entry></row><row><entry /><entry>echo -n“.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “This is all the log files parsed from the syslog.conf:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>awk ‘/{circumflex over ( )}#/∥/{circumflex over ( )}$/∥$2˜/\*/ {next} {print $2)’ /etc/syslog.conf|sort -u|while read i</entry></row><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “”</entry></row><row><entry /><entry>1s -1 $i</entry></row><row><entry /><entry>echo</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>cat $i</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>done</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “#############################################”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="4"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="42PT" align="left" /><colspec colname="2" colwidth="84PT" align="left" /><colspec colname="3" colwidth="119PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#</entry><entry>Old Log Files</entry><entry>#”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “#############################################”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo -n “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “These are old log files:”</entry></row><row><entry /><entry>echo</entry></row><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>for i in ‘cat/etc/syslog.conf|grep -v “{circumflex over ( )}#”|awk ’{print $2}‘|sort -u|grep var’</entry></row><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>for j in “$i”*.gz</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="42PT" align="left" /><colspec colname="1" colwidth="217PT" align="left" /><tbody valign="top"><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="56PT" align="left" /><colspec colname="1" colwidth="203PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “”</entry></row><row><entry /><entry>1s -1 $j</entry></row><row><entry /><entry>echo</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="56PT" align="left" /><colspec colname="1" colwidth="203PT" align="left" /><tbody valign="top"><row><entry /><entry>gunzip -c “$j”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="42PT" align="left" /><colspec colname="1" colwidth="217PT" align="left" /><tbody valign="top"><row><entry /><entry>done</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>for j in “$i”.Z</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="42PT" align="left" /><colspec colname="1" colwidth="217PT" align="left" /><tbody valign="top"><row><entry /><entry>do</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="56PT" align="left" /><colspec colname="1" colwidth="203PT" align="left" /><tbody valign="top"><row><entry /><entry>echo “”</entry></row><row><entry /><entry>1s -1 $j</entry></row><row><entry /><entry>echo</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>“*****************************************************************</entry></row><row><entry /><entry>*******”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="56PT" align="left" /><colspec colname="1" colwidth="203PT" align="left" /><tbody valign="top"><row><entry /><entry>zcat “$j”</entry></row><row><entry /><entry>echo “”</entry></row><row><entry /><entry>echo “”</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>done</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>done</entry></row><row><entry /><entry>echo “.” &gt;/dev/tty</entry></row><row><entry /><entry>echo “The script has completed; the output is named forensics.tar.Z” &gt;/dev/tty</entry></row><row><entry /><entry>if [ -x /usr/bin/md5sum ] ; then</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="28PT" align="left" /><colspec colname="1" colwidth="231PT" align="left" /><tbody valign="top"><row><entry /><entry>/usr/bin/md5sum -b forensics.txt &gt; forensics.md5</entry></row></tbody></tgroup><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="OFFSET" colwidth="14PT" align="left" /><colspec colname="1" colwidth="245PT" align="left" /><tbody valign="top"><row><entry /><entry>fi</entry></row><row><entry /><entry namest="OFFSET" nameend="1" align="center" rowsep="1" /></row></tbody></tgroup></table></tables>

[0037] The foregoing description of the preferred embodiments of this invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and obviously, many modifications and variations are possible. Such modifications and variations that may be apparent to a person skilled in the art are intended to be included within the scope of this invention as defined by the accompanying claims.