Inode
Definition
The ext2/3/4 metadata structure that holds a file's permissions, ownership, MAC times, link count and block pointers. The file name lives in the parent directory entry, not in the inode.
- Field
- Linux file system forensics
- File systems
- ext2, ext3, ext4
- Holds
- Permissions, ownership, MAC times, link count, block pointers
- Does not hold
- The file name
Common questions
Why does it matter forensically that the file name is not stored in the inode?+
Because the name lives in the parent directory entry, a file can be renamed or have multiple hard-linked names pointing to the same inode without changing the inode's own metadata, so investigators must examine directory entries separately to reconstruct naming history.
What can an examiner learn from inode MAC times that a file name alone cannot show?+
MAC times, modify, access, and change, record when the file's content or metadata last changed, which lets an investigator build a timeline of activity independent of what the file happened to be called at any given point.
Related terms
- Auditd
- The Linux Audit Daemon. Writes /var/log/audit/audit.log based on rules configured in /etc/audit/audit.rules. Read with ausearch and aureport.
- Journalctl
- The query interface to systemd-journald, the binary structured-logging daemon that backs modern Linux distributions. Binary database under /var/log/journal/.
- Plaso / Log2timeline
- The cross-artifact super-timeline tool. log2timeline.py extracts events from many sources into a .plaso storage file; psort.py renders the timeline to CSV or...
- SUID / SGID
- Set-User-ID and Set-Group-ID permission bits. A SUID binary runs with the owner's privileges regardless of the invoking user. A common persistence and...
- Wtmp / Utmp / Btmp
- Binary login databases under /var/log and /var/run. wtmp logs successful logins, utmp reflects current sessions, btmp logs failed login attempts. Read with...