The laptop that went odd on Tuesday
A laptop starts acting strangely. You are asked to find out why. You cannot ask the laptop.
But the system keeps notes about itself. Settings, logs and running jobs are all written down. Today you learn where each lives.
Key words
| Word | What it means |
|---|---|
| Investigation | Looking closely at evidence to find out what happened. |
| Configuration file | A file of settings and instructions for an app or process. |
| Registry | A Windows store of settings for hardware and software. |
| Log | A record of events, kept by a system. |
| Library and preferences | The place where macOS keeps settings files. |
| File system | The way a disk stores, manages and organises data. |
| Process | A program that is running now. |
| Evidence | Facts that show what happened. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name six parts of an OS that an investigator reads, and say where each one is found.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Configuration files, registry, library
Each OS keeps its settings in a different place.
Linux keeps configuration files in one main folder. Each file has settings for an app or process.
Windows uses the registry. It is a store of settings for hardware and software.
macOS uses the library and preferences folders.
Extra: See the Linux configuration folder
ls /etc | head -6A command for the lesson’s lab terminal. It is shown here and not run.
Read the output
The run lists the first six names in the main configuration folder. Each name is a file or a folder of settings. An investigator reads these to see how the machine was set up, and if anyone changed it.
The exact names depend on the server.
Logs
A log is a record of events: sign-ins, errors, programs that started. Logs also monitor performance and the flow of traffic.
They are the first place to look. They show who did what and when.
Extra: See the log folder
ls /var/log | head -5A command for the lesson’s lab terminal. It is shown here and not run.