Package Manager Logs (dpkg/apt/yum)

Location

Description

Package management system logs recording all software installation, removal, and upgrade operations with timestamps, package names, versions, and the action performed.

Forensic Value

Package manager logs establish a timeline of software changes that may include attacker tool installation. Unexpected package installations (nmap, netcat, tcpdump, proxychains) indicate post-compromise reconnaissance tool deployment. Package removal logs show anti-forensic cleanup attempts. Comparing installation history against authorized change management records identifies unauthorized software deployments.

Tools Required

Collection Commands

tar czf /forensics/output/pkg_logs.tar.gz /var/log/dpkg.log* /var/log/apt/ /var/log/yum.log* /var/log/dnf.log*

grep " install " /var/log/dpkg.log > /forensics/output/dpkg_installs.log

cat /var/log/apt/history.log > /forensics/output/apt_history.log

dpkg --get-selections > /forensics/output/installed_packages.txt

Collection Constraints

• •Paths and log sources vary by distribution, init system, logging stack, and installed packages. Validate the active distro and service set before treating absence as meaningful.

MITRE ATT&CK Techniques

References