Filesystem Investigation Lab

Linux FoundationsLab 1 of 2 · Guided45–60 minutesLabBuilds on: File Identity and Metadata

You can move around the Linux filesystem now, and you can inspect a file without taking its name at face value. So let’s put both of those to work on a small investigation.

This is a guided lab, so you get the commands but not the conclusion. Your job is to inspect the files, work out what they are, and check each result below.

Hands-on lab

Mission

Five files have misleading names. Work out what each one actually is, check the evidence backing your answer, and check each file type below. Usually the name is the least reliable thing in the directory.

Before you begin

Finish Linux and the Operating System, Navigating the Linux Filesystem, and File Identity and Metadata before you start. You’ll be using pwd, ls, cd, file, and stat throughout.

As you inspect each file, compare what its name suggests with what the tools show.

The supplied directory is the entire scope of this investigation. Work only inside the course VM, don’t touch public or third-party systems, and don’t modify the supplied files. Nothing outside this little pile of suspiciously named files is part of the lab.

Get the lab artifact

Download filesystem-investigation-v1.0.0.tar inside your course VM and save it in ~/underdunn-course/downloads.

This lesson uses version 1.0.0. Its expected SHA-256 hash is:

437fa0cf724dfb09804e3987d4d970451d361b24d40cfc202871e6db2829a87b

Open a terminal, move to the course download directory, and confirm the archive is actually there:

cd ~/underdunn-course/downloads
pwd
ls -l filesystem-investigation-v1.0.0.tar

Then calculate its hash:

sha256sum filesystem-investigation-v1.0.0.tar

Now compare the long string at the start of that output against the expected hash above, where they have to match exactly and character for character (a single wrong digit means a completely different file). A matching hash tells us the file holds the same bytes as the artifact this lesson was built from, and nothing weaker than that.

Safety note

Stop if the hash does not match

So delete the download using the Files application, fetch it again, and repeat the check. If it still doesn’t match, report the problem rather than trying to repair the archive yourself.

Extract a working copy

An archive packs a collection of files into a single file. Make a directory for this lab and extract the archive into it:

mkdir -p ~/underdunn-course/labs/filesystem-investigation
tar -xf filesystem-investigation-v1.0.0.tar -C ~/underdunn-course/labs/filesystem-investigation

Here tar does the archive work, -x means extract, -f says the next argument names the archive, and -C picks the destination directory.

Move into the extracted directory and confirm where you are:

cd ~/underdunn-course/labs/filesystem-investigation/filesystem-investigation-v1.0.0
pwd
ls -la

You should see START-HERE.txt and a directory called casefiles. Read the supplied instructions first:

cat START-HERE.txt

cat prints a text file to the terminal. Notice we’re using it on the known instructions and not on the unknown files (that habit is really what this whole lab is about).

Inspect the five files

Move into the case directory:

cd casefiles
pwd
ls -la

And don’t skip the -a there. One entry begins with a period, and an ordinary ls listing will leave it out completely.

Inspect these five files:

1. .maintenance
2. backup.tar
3. briefing.txt
4. diagram.png
5. records.csv

For each file, run both inspection commands:

file .maintenance
stat .maintenance

file backup.tar
stat backup.tar

file briefing.txt
stat briefing.txt

file diagram.png
stat diagram.png

file records.csv
stat records.csv

Compare each name with the type reported by file. The extension is a label; the tool inspects the contents.

Checkpoint

Compare the names with the evidence

Before moving on, consider these questions:

1. How many filename extensions accurately describe their files?
2. Which command gave you evidence about content?
3. Which command gave you size, ownership, permissions, and timestamps?

But if any of your conclusions still rest on a filename, go back to the file output.

Match the file types

Use the short names below for the types shown by file. Match each result to its filename in the check fields.

If file identifies…	Enter
ASCII text	ascii
gzip compressed data	gzip
PDF document	pdf
PNG image data	png
Zip archive data	zip

Check your answer

Check your answers

Enter the values you found. Your answers are checked in this browser without being sent anywhere.

.maintenance — file type

backup.tar — file type

briefing.txt — file type

diagram.png — file type

records.csv — file type

Check answers

Layered hints

Hint 1: I cannot find five files

Run ls -la. Ordinary listings leave out names beginning with a period.

Hint 2: The extensions and contents disagree

That’s intentional, and it’s the entire point of the lab. Use the result from file to check the content type, including where it disagrees with the extension.

Hint 3: My types look correct, but an answer does not match

Check the filename above the input. Use the short type name from the table, without version numbers or other details from the output.

Common failures

• The archive isn’t in the course download directory: check where the browser actually put it, then move only that named archive into ~/underdunn-course/downloads before you calculate the digest.
• Only four case files show up: use ls -la, because names beginning with a period stay out of an ordinary listing.
• A filename and its file result disagree: keep both observations. The mismatch is the investigation, and it’s not a reason to go renaming the supplied file.
• The checker rejects a type that looks right: check the filename above the input and use the short type name from the table.

Check your result

The checker should accept the five file types. If it doesn’t, check hidden files, type spelling and the filename above each input. The file output should explain each choice even when the extension suggests something else.

Reset or clean up

To repeat the lab, open Ubuntu’s Files application and browse to:

~/underdunn-course/labs/filesystem-investigation

Delete only the extracted filesystem-investigation-v1.0.0 directory. Keep the downloaded .tar archive, check its hash again, and repeat the extraction steps.

When you’re done for good, use Files to remove that same extracted directory, and the archive in ~/underdunn-course/downloads if you don’t want it around. You met rm -rf in the previous lesson, and during an assessment the file manager is still the safer choice. One mistyped path in a recursive delete can take a lot of work you meant to keep, and no lab is worth that.