Windows vs Linux Artifacts
Windows uses a Registry to store system, software, and user settings. What does Linux use to store this type of information? Does Linux or Windows provide more evidence (artifacts) from a forensic analysis perspective? Please explain. According to (Imam, 2017), Linux holds many file systems of the ext family, including ext2, ext3, and ext4. Linux can provide an empirical evidence if the Linux-embedded machine is recovered from a crime scene. In this case, forensic investigators should analyze the following folders and directories. /etc [%SystemRoot%/System32/config] This contains system configurations directory that holds separate configuration files for each application. /var/log This directory contains application logs and security logs. They are kept for 4-5 weeks. /home/$USER This directory holds user data and configuration information. /etc/passwd This directory has user account information. Including /etc/shadow, /etc/hosts, /etc/sysconfig, /etc/syslog.conf Windows pr...