Tweet
File System Artifacts
| Recently Accessed Files | find / -atime, ls -ltu | Accessed file times |
| Modified Files | find / -mtime, ls -lt | Recently changed files |
| Hidden Files | ls -la, find / -name ".*" | Potential hiding spots |
| SUID/SGID Files | find / -perm -4000, -2000 | Privilege escalation risk |
| World-Writable Files/Dirs | find / -perm -2 -type d | Misconfigured permissions |
| Mounted Devices | mount, /etc/fstab | Filesystem entries |