No Such Weblog

The Honeynet Project has an easy forensic challenge as May's Scan of the Month: Identify and recover a deleted rootkit from a compromised Linux system. Nice exercise for starters! (If you are looking for a more sophisticated exercise in incident handling, look at their Forensic Challenge. The solutions have been posted, but you can still just try to solve it, before reading what others have done.)