1
vote
2answers
64 views

How to acquire image of disk on Linux computer?

Pertaining to computer forensics, if the suspect's computer (which cannot be removed from the scene), is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk ...
6
votes
2answers
981 views

UID of a deleted account

How can an administrator find the UID of a user that's been deleted with the userdel command?
3
votes
1answer
481 views

Capture and log GDB backtraces without stopping the process

First, a brief description of the situation: a computer sits hidden near a display in a gallery of some sort, acting as the silent workhorse for a piece. Despite its programmer's best intentions the ...
9
votes
2answers
5k views

How to investigate cause of total hang?

My Arch machine sometimes hangs, suddenly not responding in any way to the mouse or the keyboard. The cursor is frozen. Ctrl-Alt-Backsp won't stop X11, and ctrl-alt-del does exactly nothing. The ...