The Honeynet Files

System and file analysis An important part of honeypot forensics is system analysis, which we can do without any prior knowledge of the results obtained from network analysis. The system provides information in many ways: in system logs, in normal or enhanced logs generated with a syslogd-like service (such as a firewall, security, kernel, and so on), or from the tools the intruder uses (which we can get through reverse engineering, source-code audit, and so on). Many tools exist for parsing and analyzing logfiles, but only a handful are available for reverse engineering and auditing (for example, Elfsh, http://elfsh.segfault.net; and Fenris, http://lcamtuf.coredump.cx/fenris/). Moreover, such tools require advanced skills to extract the proper data.