0

I'm looking for a forensic tool that can help me with parsing all the available information on a system, so any activity that a certain user has done which can be collected needs to be fetched and properly parse by the tool. activities such as which videos they were watching, what folders they opened and what files were accesses, logins and every possible logging information needs to be collected.

is there any tool that can help me with this?

I'm not asking for a monitoring app, which monitors users activity by itself, i need this tool to parse the currently available information on a Ubuntu system ranging from old Ubuntu versions to the newest 20.04.

based on googling, i only found gnome-activity-journal which is not that useful, and Zeitgeist but this one seems to be a activity monitor and doesnt actually collect stuff from logs. so what is my best option?

4
  • Such things are usually not logged. It may be that vlc logs which video was opened, or Rhythmbox logs which music were playing. But you don't really want us to cover all possible programs and options?! You could check if thumbnails exist or something is in the cache to get hints if something was opened ... But these are only hints.
    – pLumo
    Dec 16, 2020 at 13:08
  • But you might check ~/.local/share/recently-used.xbel or ~/.local/share/zeitgeist/activity.sqlite. Firefox has also logs in sqlite format.
    – pLumo
    Dec 16, 2020 at 13:38
  • Related Question: askubuntu.com/questions/297053/…
    – pLumo
    Dec 16, 2020 at 13:39
  • @pLumo I'm asking if there is any tool to parse all the logs and filter useless information from it, not where the logs are stored..
    – OneAndOnly
    Dec 16, 2020 at 16:17

0

You must log in to answer this question.

Browse other questions tagged .