Ubuntu Specific and General Linux Questions

The Mad Rapper · 11 May 2011 at 15:04

I am doing some general Linux research and would be grateful for informative responses to the following:

1. Using Nutty Narwhal, how do I get in to GRUB? None of the key short cuts seem to work.

2. What is the best way to reset a user account password for a PC I have access to?

3. Where does Linux keep it's installed programmes? (i.e. Equivalent of Program Files in Windows)

4. Where is the Linux version of the registry? I understand this to be /etc and that there is no registry as such, but rather a collection of config files. Correct? Anything else I need to know about this?

5. If I install apps in WINE where are they kept?

6. Where is the time zone information held? (i.e. precisely in which file in the directory structure)

7. Does Gnome or whatever keep a record of last run programmes? If so, where is that list held?

8. Where are link files stored? (i.e Equivalent of Recent in Windows)

9. Where are e-mail archives kept (for Evolution or whatever mail client)

10. How can I determine when the last login occurred?

Thanks

Cycrow · 11 May 2011 at 15:59

1. what is it u want to do with grub ? u could edit the /boot/grub/menu.lst
or i think u can install a gui app to edit it, another not sure what its called

2. Do you have superuser access to the system ? if so either in the super user login, u could try, passwd <username>
or try sudo passwd <username> if u have sudo access from your account

3. this can vary between distros, and also depends on the type of app it is.
some apps will go in thier own directory whereas others might be split into the standard directories

there are 3 main places things are installed, / /usr and /usr/local
and inside there u have /etc /bin /sbin /lib, etc
lib is for any library files, etc is for config files, bin is the executable, sbin is the superuser executable

other programs that use a lot of other files could put them anywhere, most often in /usr/share, or /var

if ur looking for specific programs that u've installed, then they'll be in one of the bin directories, most likly /usr/local/bin

4. Linux doesn't exactly work the same as windows, so there isn't really a registry as such, but yeah, etc holds all the configs for the OS and apps
but u also have the . files in your home directory, these are hidden by default thou. (use ls -a to view)

5. Inside the wine directory structure, whereever wine is set to, different distros install this into different places

6. for ubuntu, i beleive its /etc/timezone

7. i beleive its in your .gnome directory in your home directory, not sure the filename thou.
command line is in your .bash_history (if your using bash)

8. no idea tbh, something i've never looked at

9. depends on the client, but it'll be in the . files in your home directory, most likly, .evolution

10. login to what, gdm, terminal, system?
most login info is stored in /var/log/auth thou

* I should note that my knowledge of ubuntu is limited, i mainly work with command line FreeBSD, where things c an be abit different

The Mad Rapper · 11 May 2011 at 16:16

Cycrow said:
1. what is it u want to do with grub ? u could edit the /boot/grub/menu.lst
or i think u can install a gui app to edit it, another not sure what its called

I want to use GRUB to log in to Single User mode to forcibly reset the user password so the account can be accessed. I work in Computer Forensics and I want to be able to access user accounts on seized Linux PCs so that I can run them in a VM.

2. Do you have superuser access to the system ? if so either in the super user login, u could try, passwd <username>
or try sudo passwd <username> if u have sudo access from your account

No, in this scenario, all I have is physical access.

4. Linux doesn't exactly work the same as windows, so there isn't really a registry as such, but yeah, etc holds all the configs for the OS and apps
but u also have the . files in your home directory, these are hidden by default thou. (use ls -a to view)

Are any of these files any more significant than the other from the point of view of giving information about the system or what software has been installed?

9. depends on the client, but it'll be in the . files in your home directory, most likly, .evolution

How can I view those graphically? I mean to say, just through Nautilus? If I run Nautilus as sudo will that show me the .files?

10. login to what, gdm, terminal, system?
most login info is stored in /var/log/auth thou

Very grateful to you for your responses. Thanks!

Cycrow · 11 May 2011 at 17:33

1. ah i see what ur trying to do.

im asusming the grub menu pops up ?
if so, try this
1. press escape on the menu
2. press e to edit the boot entry
3. select the kernel entry and press e to edit
4. at the end of the line, add the keyword, single
5. press esc to go back to the menu
6. press b to boot the entry

2. once in single user mode, a simple, passwd, will allow you to change the root password of the system.

3. theres really know easy way to view exactly whats installed, as theres many ways to install things, but any programs will usually have an entry in bin. /usr/local/bin is the most common. Viewing what hidden files are in the home directory can give you an idea of whats installed thou. In ubuntu, u could also view the package list, but this will only list things u've installed via packages, ie apt-get/aptitude/synaptic, to list them, use: dpkg -l
/bin is mainly os programs, /usr/bin for distro/packages, and /usr/local/bin for stuff u've installed manually
althou u can technically install to any of them
/sbin is for stuff used by root

4. In nautalis, if you goto the preferences, i think in the edit menu, then there should be an option to show hidden and backup files (in the view tab), in *nix based systems, all files starting with . are treated as hidden

russ0r · 11 May 2011 at 19:10

To get into GRUB, hold down shift. Make sure you hold it, otherwise it won't work.
Password recovery: http://www.psychocats.net/ubuntu/resetpassword

If you want a list of all packages installed on the system:

Code:

apt-cache pkgnames

This won't show you anything installed from source, only stuff installed from .deb's or via aptitude/synaptic. But on your average ubuntu system that is pretty much everything.

If you're trying to do some forensics on an encrypted LVM machine though you're pretty much shafted without the key.

The Mad Rapper · 11 May 2011 at 21:40

Cycrow said:
1. ah i see what ur trying to do.

im asusming the grub menu pops up ?

That's the thing, I couldn't get the GRUB menu to appear. I'd switch it on, boot through BIOS and the flashing hyphen would appear, then load the login screen. The various key presses I tried didn't work (Esc & Shift & Alt+F2).

Having read the post below yours, it seems that I may not have held the Shift key down long enough.

Cycrow · 11 May 2011 at 22:02

or u didn't press it intime

start holding it down when the bios is up and dont let go until grub shows

The Mad Rapper · 11 May 2011 at 22:05

Cycrow said:
or u didn't press it intime

start holding it down when the bios is up and dont let go until grub shows

Will do, thanks

Essexraptor · 13 May 2011 at 02:31

Echo the above...if the drive is encrypted you'll have no luck trying to change the password on the user account

eXor · 13 May 2011 at 06:58

Essexraptor said:
Echo the above...if the drive is encrypted you'll have no luck trying to change the password on the user account

It's alarming what someone with physical access and an OS CD / DVD can do.

Long live LUKS / dm-crypt.