Percia
Computacional Forense
em
Servidores Linux

0)1."35":
"0)1."3";4
#$!%'
&"(+)*$%&,-%/2
746:89-%/2





 





*
+.
/
1
+
,
0
,
,
.

37
4
6
5
;>?
;B
;
8
5
D
:
<
=
A
=
9
@
B5
9
C
E
;H4
G<
6=
67
=
F
I
M
M
M
Q
R
R
R
R
K
K
J
N
N
O
P
N
P
U
P
W
J
P
T
T
V
V
L
S
MJ
R
R
R
R
Q
RV
K[
K
O
O
U
N
PN
J
P
O
P
Z
U
P
\
T
T
Y
Y
X
#%










!


"
$

)
)
)
'(

!


"

#













&

#
&
'
#



!
"
$
"
!
!
%
%
"
!
(
%
8
8
8
*HO*+P
*
0
2
*
0
:
:
6
6
,>G9:/H.83-?MJ6G/.
/
3
/
5
7
9
/
/
+
9
;
/
9
/
<
4
1
1
1
1
C
C
C
D
F
E
F
H
K
H
6
7
9
+
+
A
B
G
B
J
L
L
G
B
M
I
@
H
H
F
H
B
R
S
O
G
R
S
A
O
L
S
A
J
G
O
M
M
U
V
Q
Q
N
T
W
@
CJ[H\AGH^MP_CUIGFGHM]BJGBHLEGCMF@HAOLAGCBCE
BAOM@HCLACM@BHGCYXBPHCJ@E`G@OGLPAUCBOHaGBZGEP
cfeKAOAMLLLMHHLBGJCAABCBHdgd@LGEDCFCGEFHd
QHOPHHMJGBhh  








 


Conceitos

{t|ykm~mj
m{t|ykm~mj
knjolpr
qmkjskvtuopqkwxjpz}
xpz}




 

 




#!%$%&(#*'+%(,-&)!!%"$&"
.06&-1*2"+&-%&3-('%-"(/%&%%7$($4-*%$5*+&-%)
:
=
:
8
9
;
<
?
>
@
A
9
BECKDMFPELKJGCTGDLJCIDPEHGJKHCDLEKJBMEJDHPEKFQRNHCLJECOGEMCFDESINGMKHJC
SXDIEKNJEOKGGMEVHZVYHWWOPCCKMKHVWWCC
LV















   


 



!
$
!
"
%

#
(.+,)9797+,)*,-',)(7=*7.,)/-*6.(,5'.-2*'7.('7=0,-1))756''*;)2';:)4,36,52.'47)
.72/.?'7/4,7)(0+,+'(@-).,(75*7F2,')).=)9/7*/=(,6A-7)5'-,,'(+7,(+';65'6)7')7B2?./'=),C*D)')E
('*6+,'6H)57*'=A7'.527,.+I'*-+,J+47?*/6,+,='.-,/+576,676');












































































































#
!

"

%

%



#

&






































$


(










 












)
*
,-.
++
/
0
=
=
4
4
4
;
?
4
?
4
<
>
>
>
3
5
6
7
8
3
8
7
3
7
9
9
9
:
A
@
2
D
=
=
=
4
?
4
4
E
4
4
;
?
4
F
>
>
>
>
6
B
6
7
3
8
5
5
5
7
6
7
8
3
6
7
B
8
3
A
C
2
I
=>2
?
4
4
;7
4J
>
>7
H
52
3
8
67?
6
B
8=8
8
B
8
67
9
D>
=?
4
;3
4
4J
>
>87
6
3
82
5
5E
8
94
9
K
:
:
@
L
P
R
=
=
=
=
O
4
4
?
;
4
>
>
>
>
>
>
N
B
8
8
3
7
7
8
B
6
8
6
3
9
:
A
Q
S
2
=
?
;
4
4
4
;
>
>
U
>
B
8
8
5
8
5
6
3
8
5
3
9
:
:
A
C
T
2
2
4
4
?
4
4
4
4
4
>
6
3
8
8
5
5
3
N
3
3
8
6
7
8
5
8
3
8
5
5
9
:
:
A
C
2
=J
>
<
>
3
57
2
2

























%$&!'"



$


$



(


)










"
#


&
(-$(!.($"*%$+

.$%($!"
Processo

A:B?13DF30K
3A:B?13DL30>E
1405268
731091<:;5671=>06@C
HEGKIJ>6@C
























roF:
@qb<q:C=<r:qCGEs@tA:; q?:@EDCG@Ga#c"b$$
d
$




e
f



h



g


b
jb!$"
iohnbj!
d"#mlk
00!%186&2+)(3"*#+/-.)*5.+/4(/$" u$"


1[N:UM2]PO;'R6>\=^</S7:TO(3M*QUV?6,@HRBA+WCU4=(NDM_:`^5XFEQCAYGx{byz{w
}dv~|zym{|~|
I
J
D
K




" "!!
6A7789G>59?8:<BA6@87@DHEG8JC=69A>=;8I6;HA>9=8@K )%'(+!-)!!""%!&*"#"$!*&!$,
#
"

!



'
.
,
L5F6M8;69AN=A87>HG>M568<OA@H8A@=H '1)(42#(!*/)03!!"!&
ZSUxY}wipbtrSdxi\cfoySpXlzeUig]lqyr^{pi_[
PoipjQkyRmzSnlro}plUkqTriVS\s`ytYp~WSuairmS{Ylv\qTriX[
Rsqritwpl
rzoppymzw}twppuvrmwiytrmly}pkim}iwnoipyqprm}trwrlqri}qzppsipmziur{lt{
mwihtkyxul}pptwi{witnoli{pyzqpkrsimpwtuqlziqyrmqtmrirtqrmu{iywist
iiptwszkwi
miwuilm}trp}wirywr








































.!*!!,*""(+#!!#$"%(!*&'(("%+!%!,*)(!""!-*+
!)("(!*#"-!"*(*/#$"%"!!&1#//(""!%""
!.6!2*!"%"%#!#)$"%!+"*%&'2"&1374!34(-"!5("
Percia
Tcnica

JCKH:<MO<9T
<JCKH:<M<U9VN
:=9>;?A
@<:9B:ECD>?@:FG9?IL
QNPTRSG?IL





  

!"##$%'&
-.6/3((2)3*0.1+-375
)4-,:08;-9674-<

 >?@
AB 
C

G
F
I
I
K
N
L
M
S
F
K
D
E
H
J
E
E
O
Q
H
R
E
T
H
U
R
P
WWXXYYZZ`[[\YY`a\g\]`hbVX^^a`cd`YeWXYZWY\f`ec
b
Y
Y
Z
Y
`
\
`
a
`
a
`
e
W
W
\
`
e
X
X
i
f
d
j
c
c
nmXYapqWc`adm`YXrka`ealmkakmY\fqap
``XllYmmkk`aakk\mm`aYY`\\bo
Wi`YbXbVdYqW`a\mXrk eak\































,-#$,-)%-$.&&'&(&-#$)*%)!+$),,-,-)-#
1$7#.003#$#%%1%'01'4056(0
#$7.-#&$$%&$-#$89-#$%$:
>
=
@
@
B
E
C
D
J
=
B
;
<
?
A
<
<
F
H
?
I
<
K
?
L
I
G
O[OVNPQX\PQTRPS^]QSPXPQTUNQ`_NU[PUWV^UaVQWQPUTQNUNQUOVVXOTbY[PUWSN^
QPVZNSdOXNRQgihZNYSdePVX^OQfUYPeSVO^OfU^XSVOWVf^XOSjSWZVOkQOblSPQOTRSNfmOZVfOjQNXdUQ^QVXOPRXPQNO
SU`^RjXVNSWf`VRn]poTXSNR_fWddVqfOPQP[Obb

  





(!)*%(!)&%!'!&#"'"
+!&%!&'"
457890:;-7.0<:3
,-/0.12-13-6
>>GH?LR@FBCACBDGEFCASGBGHLFIKSR@ALHAJTKKBC@MV@LGWNF>GFU@BA@CKBMFRCOAXF>PR?=FCQGFC>AS@G
LA=@FBLA^R@LCGNDEZ
F>?L]@BBZ
FAFL=>W=R^F`GNP^G]UV@BCZCP>_[@N
CA=C^DGEFNYGFIGA@TR]>Z
?Z

  





)+(*,-(.*-0/
+12345+/+!-67/+"0$
#896%&(+"*
;;3+D73(+,</-96-4)-*,+=,>-(;4?,@+0@A8@A9?6A(B+*B)07E*+
(H;F+<F/9G65B)-*4B=A-60>A73,B+</96)-*=A-670>,B046






























!("!#$#%!#$#!&&
,-&."!!#$$#%/
&0)*1&2/
*)+*,3+,
4CDE6FGH576D9J6H8IG:;K<LK:MI6D>
=MFGN6D?>
@OGEALDP@QIK65EG;M6JGRD
UKFGJD\DBGFWKV
DCMDESEGLIJ\CDTHIDNDKTEEV
XNDGFJDG^ENDTFMKNED]DNDK^MJNDLTINKGbY_aZ[[GDMNHKESDKKEI
KCL\GHKEDELIFLDKcNNMI^DGNTEHGILHFDcGdGYIEGMCMFKJGFENLDEKKCM[KJGEDZLN[MeKDMcIIDLCJDETIEKBDYNaHGLKJDLED\GCKDJEIICdL_KNMDINJ[GDE
C








 




 
)
(&
'$%+%
!'*
#'
"(+#,!$)
*
-

7
.
1
2
5
1
8
2
:
1
/
0
0
3
4
6
9
;
4
;
>=GA>GHCIBJE
DBJDE
D?>CK>PB>Q=DCLMCI>G
=J>?DE@>A=AB=CD?=KE
=@DFAEB=A=FBOC>AE
>AW
>JDU<
FACGMAA>TMKCBAJ>GD@UJV
IXBJYDNCSIA=DCACDF==AMJBA?JDCZDCE
D
G
=
A
?
A
>
>
>
O
J
=BM_J\ZDB>MA>TKC^?BAFE
B
=
B
=
=
G
?
S
C
A
E
>
@
\
D
D
D
B
M
B
M
G
=
A
C
A
A
C
C
A
?
A
F
E
Z
I
\
J
D
D
M
A
A
A
?
R
X
N
N
`
a
=BJDYCI>GBPCZb>=GPA?BPCAZA>Q

Boas Prticas

!"$#

&!






 

%'
/1+;*=
2+<>:+.B,?-+-/+2314*750.))+-5;6/+2C.,)7*-5B6/D+52*<85,@A)*.9/,*5..;/
.
*)+*,;5-.;,+-0
)B0
0
1
/
/
/
.,10
.
5
5
;
;
*
;
4
+
;
)5.G-*.+@?GFKE5/),+.B;+15/7H0
)
)
)
0
0
0
E
*5A-)B,+7/5HL?M-;475/2+NI,F-.J,*.+;-O7.













 $&'(
* !"#+, $%
/ !$
'-02
.!
&300'43. (**/1
5
9
:
=
6
7
8
;
<
>
7
8
@LIMJAO@GBFJADCDCIAGFEE@FAIJEDGAAQOCESCALKGAINHJDOCIDGJRDEJFGIFC@FIACIOKEIADRFFEAGFCEPJJCCQ
DAKE\Y]cCJ^ADGGA_IT`OC@RIFBAaFiOIJDPDPQFJGAIFOXBd@JGJIFHAGDEQ@ECFIDEUFbGLJAACOJLe@HFfFJEg@OJIAJDGKFAaIVfB@jF`SDIJW_ECXSAhQ
R
R
R
HIAL@EGFA@GNFkCJCA@EHAL@JIADCBFAHGFCBIDAGJCEIjBAFDClHfCEAOKF















 

  # 
"
# 
 !
#"!$

!!(
  

 


'
'
 
(
 
)



),+ #-
# /
 #"./! 
0
4
5
8
1
2
3
6
7
9
2
3
<;OF=>?HH;OQ<EAKIG@;=;AH?BOCFDR;@NH=FEAK=GKOHIG><=;>J<OEHKH<;@GMH<EO=KGEHBP;<K;<O<LMHB<GKE>HMFEH=O
KA>;=<B@=;FHQ=RBEKGAD>GRHM@EX=<MGNEKH=EDUX<FKYGAE=Q@>B;ASHE@S;F=E><RBE;VWG

Projeto XPL

()
%$#&'

*,
+-





! "!
#

0
0
0
3
;
3
3
/
;
3
:
7
7
14
2<3DC30.71M;E54>3216260>/1?674
1
1
2
6
1
=
?
1
2
6
1
>
>
@
<
4
4
4
4
9
8
G
0
F
3
I
F
7
6
H
2
H
6
6
J
>
K
4
L
H
1=3207A8B/F/0R0<SBN30O
G6>U;<=VFQ270HOO
3=76=;6;07=3X1W3Y
14
8G<H7?3H81J733710ZO27>;313=N7N3F=;74>AB<DC.









 


0)1."35":
"0)1."3"-;4
#$!%'
&"(+)*$%&,-%/2
746:89-%/2























!

$

"


%






#
7
)
.
1
3
5
96:*
1
8
''
4
6
4/
/
+
+
+
0
0
*
*
*
,
,
,
2
(
(3
i
j
k
h
h
g
D
D
D
D
>
=
A
=
=
=
=
=
=
?
@
@
?
C
@
?
?
@
?
C
@
H
H
?
?
B
B
B
G
B
J
E
E
E
I
F
D
O
Q
O
>
=
=
=
=
P
P
=
=
=
A
@
H
M
?
H
M
?
@
M
C
H
<
?
@
G
L
L
G
G
G
G
N
R
E
E
D
D
D
=
=
=
=
P
@
?
C
@
H
?
@
?
C
@
?
?
@
B
G
B
J
B
B
G
L
G
G
G
E
E
I
F
K
D?L
D
Q
>
=
V
P
=
=
A
M
S
C
H
?
M
?
M
<
?
@
G
G
B
G
L
L
U
G
G
L
L
G
N
R
E
E
E
T
F
D
D
D
D
=
=
=
=
=
=
P
=
@
?
C
@
?
?
H
H
?
B
B
B
B
G
L
L
U
E
E
E
E
E
I
F
K
Q
OHRRRW
HG
H
C
G
GM
G
G
ab
]^
c[Z
d
^
d
^
`
_
Z
[
\
\_
[
\c
\
e
[
[
\b
f

/(&.,$.#'!$&$"%0

&(.)'*($!($!1)$&#'(&!)#$+!&%*,&0
%(/$*"&%,'(2&(0
(%/-.%'(("/,$&"%!*&($&*!
3,4
&54
&%(/$%$0
+67
8
)
!
!
"
,
1
:
0
)
;
.
$
*
$
(
.
$
*
(
.
$
*
9
%
.
&
(
(
'
'
<
<
<>=A?B@CDF
=HJILK@MNMLOHI
E= G<
QTSUQW
V
XQ






 P
R
W
ec]jbf\^xpZdchdo
]lbcn~dp|^]yga\]b_eqa^jppdb~cda^ZaZd]a|eY\{c^r
Zur
^_e_jg^`d[v\w]cbua~p[cddZr
^Zj]agb^xpidnccr
ag]adpgejkcg]npbd^dasacyltd\x]_zr
l_mgb{n}i^o
pdldj]^Zastgg
bjY
o
e
\
|
a_bY
c
x
ix^aueZbZun]dwyy\ui^j~b]qcr
ijdy_a~pxaxd\^iygZc~]]Zjld\
iapyjcnZ]~adv\r^]pjdxr
\^uZyx^\^Zj]dafcr
Zbbdr
c]pZZ\n^dxqc]xjr
bapyY
xZxjdpc~uwc^Zu]ay
ujlaj|pdwyxq^]~ducZajr
nqr
e
b
_
]
_
]
\
^
d
Z
^
d
a
p
a
~
c
c
j
b

u
a
p

Z
x
q
]jup^dZnax^i]x\uyj^jbnbZc\a^^lvujjvda]tr
p^Zn^bp]lx|y^cdcjdiaZ|\pyaubr
cp~]caddZ]c^n
r
uj^Zn\r
v]bpdyulr
^jZbaundwceypqbal\Zi~j]n^la\^pdx|d~uc]vcjZxad~\r
ajc^cy]w]duxvwr
w
c^]xZ
ydcu]qZybr
yxbijxyZ\c~balj^idcj]^a\x]yjZr
nyppd]bxat^Z]dr

X
W
Y
U
V
Z


















































































































"





















!




































$













#




"





















%

























&
+





)












'





(
























*
,

"




















.





/










, 
.

   :
0 ) 5
 
.
 

 % 

 
.


1





3

2
+































4
4




&


&

"


"
)




)




















7
9








6










!
8
!




+














;@
>C
EHDGAI=AEDJEK
?B<A=DBFC
?DL<=;=AMJOPNQRSQST
=<@