Linux Collections

AIR supports the following Linux Evidence and Artifacts

Linux Evidence List

#	Category	Evidence (click for details)	Parsed	Investigation Hub	Source Files Collected
1	System	System Controls	Yes	Yes	No
2	System	Cron Jobs	Yes	Yes	No
3	System	AppArmor Profiles	Yes	Yes	No
4	System	ULimit Information	Yes	Yes	No
5	System	Kernel Modules	Yes	Yes	No
6	System	Lock Files	Yes	Yes	No
7	System	Systemctl Services	Yes	Yes	No
8	Disk	Block Devices	Yes	Yes	No
9	Disk	Fstab	Yes	Yes	No
10	Disk	Mounts	Yes	Yes	No
11	Disk	NFS Exports	Yes	Yes	No
12	File System	File System Enumeration	Yes	Yes	No
13	Processes	Processes	Yes	Yes	No
14	Processes	Process Open Files	Yes	Yes	No
15	Memory	Shared Memory	Yes	Yes	No
16	Memory	Memory Map	Yes	Yes	No
17	Memory	Swaps	Yes	Yes	No
18	Memory	RAM Image	Yes	Yes	No
19	Browser	Default Browser	Yes	Yes	No
20	Browser	Chrome Cookies	Yes	Yes	No
21	Browser	Chromium Cookies	awaits	awaits	awaits
22	Browser	Edge Cookies	Yes	Yes	No
23	Browser	Opera Cookies	awaits	awaits	awaits
24	Browser	Vivaldi Cookies	awaits	awaits	awaits
25	Browser	Brave Cookies	awaits	awaits	awaits
26	Browser	Chrome Bookmarks	Yes	Yes	No
27	Browser	Chromium Bookmarks	awaits	awaits	awaits
28	Browser	Edge Bookmarks	Yes	Yes	No
29	Browser	Opera Bookmarks	awaits	awaits	awaits
30	Browser	Vivaldi Bookmarks	awaits	awaits	awaits
31	Browser	Brave Bookmarks	awaits	awaits	awaits
32	Browser	Chrome User Profiles	Yes	Yes	No
33	Browser	Chromium User Profiles	awaits	awaits	awaits
34	Browser	Edge User Profiles	Yes	Yes	No
35	Browser	Opera User Profiles	awaits	awaits	awaits
36	Browser	Vivaldi User Profiles	awaits	awaits	awaits
37	Browser	Brave User Profiles	awaits	awaits	awaits
38	Browser	Chrome Extensions	Yes	Yes	No
39	Browser	Firefox Extensions	Yes	Yes	No
40	Browser	Chrome Local Storage	Yes	Yes	No
41	Browser	Chromium Local Storage	awaits	awaits	awaits
42	Browser	Edge Local Storage	Yes	Yes	No
43	Browser	Opera Local Storage	awaits	awaits	awaits
44	Browser	Vivaldi Local Storage	awaits	awaits	awaits
45	Browser	Brave Local Storage	awaits	awaits	awaits
46	Browser	Dump Chrome Indexed DB	awaits	awaits	awaits
47	Browser	Dump Chromium Indexed DB	awaits	awaits	awaits
48	Browser	Dump Edge Indexed DB	awaits	awaits	awaits
49	Browser	Dump Opera Indexed DB	awaits	awaits	awaits
50	Browser	Dump Vivaldi Indexed DB	awaits	awaits	awaits
51	Browser	Dump Brave Indexed DB	awaits	awaits	awaits
52	Browser	Chrome Web Storage	Yes	Yes	No
53	Browser	Chromium Web Storage	awaits	awaits	awaits
54	Browser	Edge Web Storage	Yes	Yes	No
55	Browser	Opera Web Storage	awaits	awaits	awaits
56	Browser	Vivaldi Web Storage	awaits	awaits	awaits
57	Browser	Brave Web Storage	awaits	awaits	awaits
58	Browser	Chrome Form History	Yes	Yes	No
59	Browser	Chromium Form History	awaits	awaits	awaits
60	Browser	Edge Form History	Yes	Yes	No
61	Browser	Opera Form History	awaits	awaits	awaits
62	Browser	Vivaldi Form History	awaits	awaits	awaits
63	Browser	Brave Form History	awaits	awaits	awaits
64	Browser	Chrome Thumbnails	Yes	Yes	No
65	Browser	Chromium Thumbnails	awaits	awaits	awaits
66	Browser	Edge Thumbnails	Yes	Yes	No
67	Browser	Opera Thumbnails	awaits	awaits	awaits
68	Browser	Vivaldi Thumbnails	awaits	awaits	awaits
69	Browser	Brave Thumbnails	awaits	awaits	awaits
70	Browser	Chrome Favicons	Yes	Yes	No
71	Browser	Chromium Favicons	awaits	awaits	awaits
72	Browser	Edge Favicons	Yes	Yes	No
73	Browser	Opera Favicons	awaits	awaits	awaits
74	Browser	Vivaldi Favicons	awaits	awaits	awaits
75	Browser	Brave Favicons	awaits	awaits	awaits
76	Browser	Chrome Login Data	Yes	Yes	No
77	Browser	Chromium Login Data	awaits	awaits	awaits
78	Browser	Edge Login Data	Yes	Yes	No
79	Browser	Opera Login Data	awaits	awaits	awaits
80	Browser	Vivaldi Login Data	awaits	awaits	awaits
81	Browser	Brave Login Data	awaits	awaits	awaits
82	Browser	Chrome Sessions	Yes	Yes	No
83	Browser	Chromium Sessions	awaits	awaits	awaits
84	Browser	Brave Sessions	awaits	awaits	awaits
85	Browser	Edge Sessions	Yes	Yes	No
86	Browser	Opera Sessions	awaits	awaits	awaits
87	Browser	Vivaldi Sessions	awaits	awaits	awaits
88	Browser	Chrome Browsing History	Yes	Yes	No
89	Browser	Firefox Browsing History	Yes	Yes	No
90	Browser	Chromium Browsing History	awaits	awaits	awaits
91	Browser	Edge Browsing History	Yes	Yes	No
92	Browser	Opera Browsing History	awaits	awaits	awaits
93	Browser	Vivaldi Browsing History	awaits	awaits	awaits
94	Browser	Brave Browsing History	awaits	awaits	awaits
95	Browser	Chrome Downloads	Yes	Yes	No
96	Browser	Chromium Downloads	awaits	awaits	awaits
97	Browser	Firefox Downloads	Yes	Yes	No
98	Browser	Brave Downloads	awaits	awaits	awaits
99	Browser	Edge Downloads	Yes	Yes	No
100	Browser	Opera Downloads	awaits	awaits	awaits
101	Browser	Vivaldi Downloads	awaits	awaits	awaits
102	Browser	Firefox Cookies	Yes	Yes	No
103	Users	User Groups	Yes	Yes	No
104	Users	Users	Yes	Yes	No
105	Users	Last Access	Yes	Yes	No
106	Users	Logged Users	Yes	Yes	No
107	Users	Shadow	Yes	Yes	No
108	Users	Sudoers	Yes	Yes	No
109	Users	Failed Login Attempts	Yes	Yes	No
110	SSH	SSH Known Hosts	Yes	Yes	No
111	SSH	SSH Authorized Keys	Yes	Yes	No
112	SSH	SSH Configs	Yes	Yes	No
113	SSH	SSHD Configs	Yes	Yes	No
114	Network	Hosts	Yes	Yes	No
115	Network	ICMP Table	Yes	Yes	No
116	Network	IP Routes	Yes	Yes	No
117	Network	IP Tables	Yes	Yes	No
118	Network	Raw Table	Yes	Yes	No
119	Network	Network Interfaces	Yes	Yes	No
120	Network	TCP Table	Yes	Yes	No
121	Network	UDPLite Table	Yes	Yes	No
122	Network	UDP Table	Yes	Yes	No
123	Network	Unix Sockets	Yes	Yes	No
124	Network	ARP Table	Yes	Yes	No
125	Network	DNS Resolvers	Yes	Yes	No
126	Other Evidence	APT Sources	Yes	Yes	No
127	Other Evidence	APT History	Yes	Yes	No
128	Other Evidence	DEB Packages	Yes	Yes	No
129	Other Evidence	YUM Sources	Yes	Yes	No
130	Other Evidence	SELinux Configs	Yes	Yes	No
131	Other Evidence	SELinux Settings	Yes	Yes	No
132	Other Evidence	SUID Binaries	Yes	Yes	No
133	Other Evidence	Shell History	Yes	Yes	No
134	Other Evidence	System Artifacts	Yes	Yes	No
135	Other Evidence	Log Files	Yes	Yes	No

Linux Artifact List

#	Category	Artifact (click for details)	Parsed	Investigation Hub	Source Files Collected
1	Server	Apache Logs	awaits	awaits	awaits
2	Server	NGINX Logs	awaits	awaits	awaits
3	Server	MongoDB Logs	awaits	awaits	awaits
4	Server	MySQL Logs	awaits	awaits	awaits
5	Server	PostgreSQL Logs	awaits	awaits	awaits
6	Server	SSH Server Logs	awaits	awaits	awaits
7	Server	DHCP Server Logs	awaits	awaits	awaits
8	System	System Logs	awaits	awaits	awaits
9	System	Messages	awaits	awaits	awaits
10	System	Auth Logs	awaits	awaits	awaits
11	System	Secure	awaits	awaits	awaits
12	System	Boot Logs	awaits	awaits	awaits
13	System	Kernel Logs	awaits	awaits	awaits
14	System	Mail Logs	awaits	awaits	awaits
15	Docker	Docker Changes	Yes	Yes	No
16	Docker	Docker Containers	Yes	Yes	No
17	Docker	Docker Image History	Yes	Yes	No
18	Docker	Docker Images	Yes	Yes	No
19	Docker	Docker Info	Yes	Yes	No
20	Docker	Docker Networks	Yes	Yes	No
21	Docker	Docker Processes	Yes	Yes	No
22	Docker	Docker Volumes	Yes	Yes	No
23	Docker	Docker Container Logs	Yes	Yes	No
24	Docker	Docker Logs	Yes	Yes	No
25	Communication	AnyDesk Logs	awaits	awaits	awaits