Home / Labs / Preserve Evidence

Preserve Evidence

The attacker is still logged in. Capture volatile evidence before their session vanishes.

Open this lab

Commands practised here

• whoShows all logged-in users.
• ps auxLists all running processes.
• netstat -tlnpShows all active TCP connections.
• who > /evidence/users.txtSaves logged-in users to a file.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Deep Port Scan
• Catch the Rogue Processes