Forensics

Relying on standard shell history (~/.bash_history) for security auditing is fundamentally flawed: users can unset HISTFILE, launch sessions inside screen/tmux, prepend commands with spaces, or delete history files before logout. To reliably monitor user commands at the kernel level, Linux provides the pam_tty_audit PAM module. This module enables TTY input logging directly through the Linux Audit daemon (auditd), capturing keystrokes before the shell receives them. Module Parameters pam_tty_audit.so supports three key arguments: ...

Encrypted disk containers generated by TrueCrypt (and modern successors like VeraCrypt) do not contain detectable headers or magic bytes. The container appears indistinguishable from random noise, protecting against forensic identification. During forensic investigations or lost credential recovery, if specialized GPU cracking tools (such as Hashcat or John the Ripper) are unavailable, you can audit container passwords using a headless CLI mounting script. Python Dictionary Testing Script (tc_crack.py) This script iterates through a wordlist, attempting non-interactive mount commands against the target container file until a successful exit status is returned: ...