Explore BrainMass

Usefulness of some UNIX commands to forensic investigators

1. Explain in layman terms the following UNIX commands. For each command, point out its usefulness to forensic investigators.


2. What does the term "pipe" mean in UNIX? Give 3 examples to illustrate your answer.

Solution Preview


It enables people to see who else is using the computer system as well as find basic information about a user. To find information about a specific user, it is necessary to know that person's email address. For example, in response to the command "finger [email address removed by system]" a computer running the Finger program would respond with information like following.

Login name: atstarr In real life: Andrew Starr
Office: Kansas City Home phone: 555-5555
Last login Mon Nov 8 13:22 on ttyre from sdn-ar-001mokcit

To come so far one must be brave.
[email address removed by system]


Typical information provided by Finger command would be a person's real name, his office location and phone number, and the last time he logged in. Users can modify the plan field to add whatever additional text they want to be shown for them. In this example, Andrew added a quotation, his email address, and the URL for his web page.

Usefulness to forensic investigators:

Finger experts know that fingering "@","0", and "", as well as common names, such as root, bin, ftp, system, guest, demo, manager, etc. can reveal interesting information. What that information is depends on the version of finger daemon that your target is running, but the most notable are account names, along with their home directories and the host that they last logged in from.

Reference: http://www.rajivshah.com/Case_Studies/Finger/Finger.htm


The showmount <Host> command displays a list of all exported directories from a specified machine in the Host parameter.

Usefulness to forensic investigators:

Showmount queries the mount daemon on a remote host for information about the state of the NFS server on that machine.


The Unix command line utility "mount" instructs the operating system that a file system is ready to use, and associates it with a particular point in the system's file system hierarchy (its mount point).

The mount command attaches disks, or directories logically rather than physically. The Unix mount command makes a directory accessible by attaching a root directory of one file system to another directory, which makes all the file systems usable as if they were subdirectories of the file system they are attached to.

Usefulness to forensic investigators:

Mount the home directory of user "guest." Since you don't have a corresponding account on the local ...

Solution Summary

Solution clearly explains the usefulness of some popular UNIX command showmount, mount, echo, rlogin, whoami, rsh, rpcinfo, ypwhich, tcpmap, telnet, pipe to forensic investigators and also meaning of pipe operation with examples.