Linux Collections

AIR supports the following Linux Evidence and Artifacts

Linux Evidence List

1	System	System Controls	Collect system controls
2	System	Cron Jobs	Collect cron jobs
3	System	AppArmor Profiles	Collect AppArmor profiles
4	System	ULimit Information	Collect ulimit information
5	System	Kernel Modules	Collect kernel modules
6	System	Lock Files	Collect lock files
7	System	Systemctl Services	Collect Systemctl Running Services
8	Disk	Block Devices	Collect block devices
9	Disk	Fstab	Collect fstab configuration
10	Disk	Mounts	Collect mounts
11	Disk	NFS Exports	Collect NFS exports
12	File System	File System Enumeration	Dump file and folder information.
13	Processes	Processes	Collect process list
14	Processes	Process Open Files	Collect process open files information
15	Memory	Shared Memory	Collect shared memory
16	Memory	Memory Map	Collect memory map
17	Memory	Swaps	Collect swap info
18	Memory	RAM Image	Create an image of RAM
19	Browser	Default Browser	Collect Default Browser
20	Browser	Chrome Cookies	Collect Chrome Cookies
21	Browser	Chromium Cookies	Collect Chromium Cookies
22	Browser	Edge Cookies	Collect Edge Cookies
23	Browser	Opera Cookies	Collect Opera Cookies
24	Browser	Vivaldi Cookies	Collect Vivaldi Cookies
25	Browser	Brave Cookies	Collect Brave Cookies
26	Browser	Chrome Bookmarks	Collect Chrome Bookmarks
27	Browser	Chromium Bookmarks	Collect Chromium Bookmarks
28	Browser	Edge Bookmarks	Collect Edge Bookmarks
29	Browser	Opera Bookmarks	Collect Opera Bookmarks
30	Browser	Vivaldi Bookmarks	Collect Vivaldi Bookmarks
31	Browser	Brave Bookmarks	Collect Brave Bookmarks
32	Browser	Chrome User Profiles	Collect Chrome User Profiles
33	Browser	Chromium User Profiles	Collect Chromium User Profiles
34	Browser	Edge User Profiles	Collect Edge User Profiles
35	Browser	Opera User Profiles	Collect Opera User Profiles
36	Browser	Vivaldi User Profiles	Collect Vivaldi User Profiles
37	Browser	Brave User Profiles	Collect Brave User Profiles
38	Browser	Chrome Extensions	Collect Chrome Extensions
39	Browser	Firefox Extensions	Collect Firefox Extensions (Addons)
40	Browser	Chrome Local Storage	Collect Chrome Local Storage
41	Browser	Chromium Local Storage	Collect Chromium Local Storage
42	Browser	Edge Local Storage	Collect Edge Local Storage
43	Browser	Opera Local Storage	Collect Opera Local Storage
44	Browser	Vivaldi Local Storage	Collect Vivaldi Local Storage
45	Browser	Brave Local Storage	Collect Brave Local Storage
46	Browser	Dump Chrome Indexed DB	Dump Chrome Indexed DB
47	Browser	Dump Chromium Indexed DB	Dump Chromium Indexed DB
48	Browser	Dump Edge Indexed DB	Dump Edge Indexed DB
49	Browser	Dump Opera Indexed DB	Dump Opera Indexed DB
50	Browser	Dump Vivaldi Indexed DB	Dump Vivaldi Indexed DB
51	Browser	Dump Brave Indexed DB	Dump Brave Indexed DB
52	Browser	Chrome Web Storage	Collect Chrome Web Storage
53	Browser	Chromium Web Storage	Collect Chromium Web Storage
54	Browser	Edge Web Storage	Collect Edge Web Storage
55	Browser	Opera Web Storage	Collect Opera Web Storage
56	Browser	Vivaldi Web Storage	Collect Vivaldi Web Storage
57	Browser	Brave Web Storage	Collect Brave Web Storage
58	Browser	Chrome Form History	Collect Chrome Form History
59	Browser	Chromium Form History	Collect Chromium Form History
60	Browser	Edge Form History	Collect Edge Form History
61	Browser	Opera Form History	Collect Opera Form History
62	Browser	Vivaldi Form History	Collect Vivaldi Form History
63	Browser	Brave Form History	Collect Brave Form History
64	Browser	Chrome Thumbnails	Collect Chrome Thumbnails
65	Browser	Chromium Thumbnails	Collect Chromium Thumbnails
66	Browser	Edge Thumbnails	Collect Edge Thumbnails
67	Browser	Opera Thumbnails	Collect Opera Thumbnails
68	Browser	Vivaldi Thumbnails	Collect Vivaldi Thumbnails
69	Browser	Brave Thumbnails	Collect Brave Thumbnails
70	Browser	Chrome Favicons	Collect Chrome Favicons
71	Browser	Chromium Favicons	Collect Chromium Favicons
72	Browser	Edge Favicons	Collect Edge Favicons
73	Browser	Opera Favicons	Collect Opera Favicons
74	Browser	Vivaldi Favicons	Collect Vivaldi Favicons
75	Browser	Brave Favicons	Collect Brave Favicons
76	Browser	Chrome Login Data	Collect Chrome Login Data
77	Browser	Chromium Login Data	Collect Chromium Login Data
78	Browser	Edge Login Data	Collect Edge Login Data
79	Browser	Opera Login Data	Collect Opera Login Data
80	Browser	Vivaldi Login Data	Collect Vivaldi Login Data
81	Browser	Brave Login Data	Collect Brave Login Data
82	Browser	Chrome Sessions	Collect Chrome Sessions
83	Browser	Chromium Sessions	Collect Chromium Sessions
84	Browser	Brave Sessions	Collect Brave Sessions
85	Browser	Edge Sessions	Collect Edge Sessions
86	Browser	Opera Sessions	Collect Opera Sessions
87	Browser	Vivaldi Sessions	Collect Vivaldi Sessions
88	Browser	Chrome Browsing History	Collect visited URLs from Google Chrome
89	Browser	Firefox Browsing History	Collect visited URLs from Mozilla Firefox
90	Browser	Chromium Browsing History	Collect visited URLs from Chromium
91	Browser	Edge Browsing History	Collect visited URLs from Edge
92	Browser	Opera Browsing History	Collect Visited URLs from Opera
93	Browser	Vivaldi Browsing History	Collect visited URLs from Vivaldi
94	Browser	Brave Browsing History	Collect visited URLs from Brave
95	Browser	Chrome Downloads	Collect Chrome Downloads
96	Browser	Chromium Downloads	Collect Chromium Downloads
97	Browser	Firefox Downloads	Collect Firefox Downloads
98	Browser	Brave Downloads	Collect Brave Downloads
99	Browser	Edge Downloads	Collect Edge Downloads
100	Browser	Opera Downloads	Collect Opera Downloads
101	Browser	Vivaldi Downloads	Collect Vivaldi Downloads
102	Browser	Firefox Cookies	Collect Firefox Cookies
103	Users	User Groups	Collect user group list
104	Users	Users	Collect user list
105	Users	Last Access	Collect last access records
106	Users	Logged Users	Collect logged user list
107	Users	Shadow	Collect shadow content
108	Users	Sudoers	Collect sudoers
109	Users	Failed Login Attempts	Collect fail login attempts
110	SSH	SSH Known Hosts	Collect SSH known hosts
111	SSH	SSH Authorized Keys	Collect SSH authorized keys
112	SSH	SSH Configs	Collect SSH configurations
113	SSH	SSHD Configs	Collect SSHD configurations
114	Network	Hosts	Collect hosts
115	Network	ICMP Table	Collect ICMP table
116	Network	IP Routes	Collect IP routes
117	Network	IP Tables	Collect IP tables
118	Network	Raw Table	Collect Raw table
119	Network	Network Interfaces	Collect network interfaces
120	Network	TCP Table	Collect TCP table
121	Network	UDPLite Table	Collect UDPLite table
122	Network	UDP Table	Collect UDP table
123	Network	Unix Sockets	Collect unix sockets
124	Network	ARP Table	Collect ARP table
125	Network	DNS Resolvers	Collect DNS resolvers
126	Other Evidence	APT Sources	Collect APT sources
127	Other Evidence	APT History	Collect APT history
128	Other Evidence	DEB Packages	Collect Debian packages
129	Other Evidence	YUM Sources	Collect YUM sources
130	Other Evidence	SELinux Configs	Collect SELinux configurations
131	Other Evidence	SELinux Settings	Collect SELinux settings
132	Other Evidence	SUID Binaries	Collect SUID binaries
133	Other Evidence	Shell History	Collect shell history
134	Other Evidence	System Artifacts	Collect system artifacts (Files of collected evidence. For example: /etc/passwd file)
135	Other Evidence	Log Files	Collect log files under /var/log/

Linux Artifact List

1	Server	Apache Logs	Collect Apache Logs
2	Server	NGINX Logs	Collect NGINX Logs
3	Server	MongoDB Logs	Collect MongoDB Logs
4	Server	MySQL Logs	Collect MySQL Logs
5	Server	PostgreSQL Logs	Collect PostgreSQL Logs
6	Server	SSH Server Logs	Collect SSH Server Logs
7	Server	DHCP Server Logs	Collect DHCP Server Logs
8	System	System Logs	Collect System Logs
9	System	Messages	Collect Messages Logs
10	System	Auth Logs	Collect Auth Logs
11	System	Secure	Collect Secure Logs
12	System	Boot Logs	Collect Boot Logs
13	System	Kernel Logs	Collect Kernel Logs
14	System	Mail Logs	Collect Mail Logs
15	Docker	Docker Changes	Collect Docker Changes.
16	Docker	Docker Containers	Collect Docker Containers.
17	Docker	Docker Image History	Collect Docker Image History.
18	Docker	Docker Images	Collect Docker Images.
19	Docker	Docker Info	Collect Docker Info.
20	Docker	Docker Networks	Collect Docker Networks.
21	Docker	Docker Processes	Collect Docker Processes.
22	Docker	Docker Volumes	Collect Docker Volumes.
23	Docker	Docker Container Logs	Collect Docker Container Logs
24	Docker	Docker Logs	Collect Docker Logs on Filesystem
25	Communication	AnyDesk Logs	Collect AnyDesk Logs