Linux Collections

AIR supports the following Linux Evidence and Artifacts

Linux Evidence List

#	Category	Evidence (click for details)	Parsed	Sent to the Investigation Hub	Source Files Collected
1	Applications	Brave Bookmarks	Yes	Yes	No
2	Applications	Brave Browsing History	Yes	Yes	No
3	Applications	Brave Cookies	Yes	Yes	No
4	Applications	Brave Downloads	Yes	Yes	No
5	Applications	Brave Favicons	Yes	Yes	No
6	Applications	Brave Form History	Yes	Yes	No
7	Applications	Brave Local Storage	Yes	Yes	No
8	Applications	Brave Login Data	Yes	Yes	No
9	Applications	Brave Sessions	Yes	Yes	No
10	Applications	Brave Thumbnails	Yes	Yes	No
11	Applications	Brave User Profiles	Yes	Yes	No
12	Applications	Brave Web Storage	Yes	Yes	No
13	Applications	Chrome Bookmarks	Yes	Yes	No
14	Applications	Chrome Browsing History	Yes	Yes	No
15	Applications	Chrome Cookies	Yes	Yes	No
16	Applications	Chrome Downloads	Yes	Yes	No
17	Applications	Chrome Extensions	Yes	Yes	No
18	Applications	Chrome Favicons	Yes	Yes	No
19	Applications	Chrome Form History	Yes	Yes	No
20	Applications	Chrome Local Storage	Yes	Yes	No
21	Applications	Chrome Login Data	Yes	Yes	No
22	Applications	Chrome Sessions	Yes	Yes	No
23	Applications	Chrome Thumbnails	Yes	Yes	No
24	Applications	Chrome User Profiles	Yes	Yes	No
25	Applications	Chrome Web Storage	Yes	Yes	No
26	Applications	Chromium Bookmarks	Yes	Yes	No
27	Applications	Chromium Browsing History	Yes	Yes	No
28	Applications	Chromium Cookies	Yes	Yes	No
29	Applications	Chromium Downloads	Yes	Yes	No
30	Applications	Chromium Favicons	Yes	Yes	No
31	Applications	Chromium Form History	Yes	Yes	No
32	Applications	Chromium Local Storage	Yes	Yes	No
33	Applications	Chromium Login Data	Yes	Yes	No
34	Applications	Chromium Sessions	Yes	Yes	No
35	Applications	Chromium Thumbnails	Yes	Yes	No
36	Applications	Chromium User Profiles	Yes	Yes	No
37	Applications	Chromium Web Storage	Yes	Yes	No
38	Applications	Default Browser	Yes	Yes	No
39	Applications	Docker Changes	Yes	Yes	No
40	Applications	Docker Container Logs	Yes	Yes	No
41	Applications	Docker Containers	Yes	Yes	No
42	Applications	Docker Image History	Yes	Yes	No
43	Applications	Docker Images	Yes	Yes	No
44	Applications	Docker Info	Yes	Yes	No
45	Applications	Docker Networks	Yes	Yes	No
46	Applications	Docker Processes	Yes	Yes	No
47	Applications	Docker Volumes	Yes	Yes	No
48	Applications	Dump Brave Indexed DB	Yes	Yes	No
49	Applications	Dump Chrome Indexed DB	Yes	Yes	No
50	Applications	Dump Chromium Indexed DB	Yes	Yes	No
51	Applications	Dump Edge Indexed DB	Yes	Yes	No
52	Applications	Dump Opera Indexed DB	Yes	Yes	No
53	Applications	Dump Vivaldi Indexed DB	Yes	Yes	No
54	Applications	Edge Bookmarks	Yes	Yes	No
55	Applications	Edge Browsing History	Yes	Yes	No
56	Applications	Edge Cookies	Yes	Yes	No
57	Applications	Edge Downloads	Yes	Yes	No
58	Applications	Edge Favicons	Yes	Yes	No
59	Applications	Edge Form History	Yes	Yes	No
60	Applications	Edge Local Storage	Yes	Yes	No
61	Applications	Edge Login Data	Yes	Yes	No
62	Applications	Edge Sessions	Yes	Yes	No
63	Applications	Edge Thumbnails	Yes	Yes	No
64	Applications	Edge User Profiles	Yes	Yes	No
65	Applications	Edge Web Storage	Yes	Yes	No
66	Applications	Failed Login Attempts	Yes	Yes	No
67	Applications	Firefox Browsing History	Yes	Yes	No
68	Applications	Firefox Cookies	Yes	Yes	No
69	Applications	Firefox Downloads	Yes	Yes	No
70	Applications	Firefox Extensions	Yes	Yes	No
71	Applications	Last Access	Yes	Yes	No
72	Applications	Logged Users	Yes	Yes	No
73	Applications	Opera Bookmarks	Yes	Yes	No
74	Applications	Opera Browsing History	Yes	Yes	No
75	Applications	Opera Cookies	Yes	Yes	No
76	Applications	Opera Downloads	Yes	Yes	No
77	Applications	Opera Favicons	Yes	Yes	No
78	Applications	Opera Form History	Yes	Yes	No
79	Applications	Opera Local Storage	Yes	Yes	No
80	Applications	Opera Login Data	Yes	Yes	No
81	Applications	Opera Sessions	Yes	Yes	No
82	Applications	Opera Thumbnails	Yes	Yes	No
83	Applications	Opera User Profiles	Yes	Yes	No
84	Applications	Opera Web Storage	Yes	Yes	No
85	Applications	Shadow	Yes	Yes	No
86	Applications	Sudoers	Yes	Yes	No
87	Applications	Vivaldi Bookmarks	Yes	Yes	No
88	Applications	Vivaldi Browsing History	Yes	Yes	No
89	Applications	Vivaldi Cookies	Yes	Yes	No
90	Applications	Vivaldi Downloads	Yes	Yes	No
91	Applications	Vivaldi Favicons	Yes	Yes	No
92	Applications	Vivaldi Form History	Yes	Yes	No
93	Applications	Vivaldi Local Storage	Yes	Yes	No
94	Applications	Vivaldi Login Data	Yes	Yes	No
95	Applications	Vivaldi Sessions	Yes	Yes	No
96	Applications	Vivaldi Thumbnails	Yes	Yes	No
97	Applications	Vivaldi User Profiles	Yes	Yes	No
98	Applications	Vivaldi Web Storage	Yes	Yes	No
99	DiskFilesystem	Block Devices	Yes	Yes	No
100	DiskFilesystem	File System Enumeration as CSV	Yes	Yes	No
101	DiskFilesystem	Fstab	Yes	Yes	No
102	DiskFilesystem	Mounts	Yes	Yes	No
103	DiskFilesystem	NFS Exports	Yes	Yes	No
104	Memory	Memory Map	Yes	Yes	No
105	Memory	RAM Image	Yes	Yes	No
106	Memory	Shared Memory	Yes	Yes	No
107	Memory	Swaps	Yes	Yes	No
108	Network	ARP Table	Yes	Yes	No
109	Network	DNS Resolvers	Yes	Yes	No
110	Network	Hosts	Yes	Yes	No
111	Network	ICMP Table	Yes	Yes	No
112	Network	IP Routes	Yes	Yes	No
113	Network	IP Tables	Yes	Yes	No
114	Network	Network Interfaces	Yes	Yes	No
115	Network	Raw Table	Yes	Yes	No
116	Network	SSH Authorized Keys	Yes	Yes	No
117	Network	SSH Configs	Yes	Yes	No
118	Network	SSH Files	No	Yes	Yes
119	Network	SSH Known Hosts	Yes	Yes	No
120	Network	SSHD Configs	Yes	Yes	No
121	Network	TCP Table	Yes	Yes	No
122	Network	UDP Table	Yes	Yes	No
123	Network	UDPLite Table	Yes	Yes	No
124	Network	Unix Sockets	Yes	Yes	No
125	System	APT History	Yes	Yes	No
126	System	APT Sources	Yes	Yes	No
127	System	AppArmor Profiles	Yes	Yes	No
128	System	Cron Jobs	Yes	Yes	No
129	System	DEB Packages	Yes	Yes	No
130	System	DNF History	Yes	Yes	No
131	System	ETC Files	No	Yes	Yes
132	System	Kernel Modules	Yes	Yes	No
133	System	Lock Files	Yes	Yes	No
134	System	Log Files	Yes	Yes	No
135	System	Process Open Files	Yes	Yes	No
136	System	Processes	Yes	Yes	No
137	System	SELinux Configs	Yes	Yes	No
138	System	SELinux Settings	Yes	Yes	No
139	System	SUID Binaries	Yes	Yes	No
140	System	Shell History	Yes	Yes	No
141	System	Sysmon Logs	Yes	Yes	No
142	System	System Artifacts	Yes	Yes	No
143	System	System Controls	Yes	Yes	No
144	System	Systemctl Services	Yes	Yes	No
145	System	ULimit Information	Yes	Yes	No
146	System	User Groups	Yes	Yes	No
147	System	Users	Yes	Yes	No
148	System	YUM History	Yes	Yes	No
149	System	YUM Sources	Yes	Yes	No

Linux Artifact List:

#	Category	Evidence (click for details)	Parsed	Sent to the Investigation Hub	Source Files Collected
1	Applications	AnyDesk Logs	No	No	Yes
2	Applications	Apache Logs	No	No	Yes
3	Applications	DHCP Server Logs	No	No	Yes
4	Applications	Docker Logs	No	No	Yes
5	Applications	MongoDB Logs	No	No	Yes
6	Applications	MySQL Logs	No	No	Yes
7	Applications	NGINX Logs	No	No	Yes
8	Applications	PostgreSQL Logs	No	No	Yes
9	Applications	SSH Server Logs	No	No	Yes
10	System	Auth Logs	No	No	Yes
11	System	Boot Logs	No	No	Yes
12	System	Kernel Logs	No	No	Yes
13	System	Mail Logs	No	No	Yes
14	System	Messages	No	No	Yes
15	System	Secure	No	No	Yes
16	System	System Logs	No	No	Yes