With Linux-based servers and cloud infrastructure becoming major targets of cyber attacks, Maestro Forensics has expanded the scope of its server forensic response by releasing 'MAESTRO WiSDOM Linux,' which enhances analysis capabilities for major Linux distributions.

Maestro Forensics announced on February 24 in Seoul that it has released an AI-based automated digital forensics solution that enhances file system analysis for major Linux distributions such as Red Hat and Ubuntu.

Recently, ransomware, web server breaches, and supply chain attacks have been spreading, primarily centered around Linux server environments. As a significant portion of corporate business systems and cloud infrastructures operate on a Linux basis, there is a growing demand for Digital Forensics and Incident Response (DFIR) capabilities to comprehensively analyze logs and the entire file system in the event of a breach.

Technically, the core of this update is support for detailed analysis of EXT2, EXT3, EXT4, and XFS file systems. EXT family is widely used in general-purpose Linux environments, while XFS is used in large-capacity, high-performance servers. In particular, it has been pointed out that the scope of analysis for XFS is limited in some existing tools, and the expanded support for this is seen as significant for analyzing large-scale server and storage environments.

Existing Linux forensic tools have often been limited to analysis centered on specific distributions or logs. Field feedback has also been raised that it has been difficult to comprehensively analyze system configurations, user activity logs (wtmp, btmp, utmp), remote access records (SSH, SCP, rsync), web logs, and database traces.

Maestro Wisdom Linux is designed to extract and analyze over 250 types of digital artifacts based on file system structure, metadata, deleted files, and change history. The analysis results are integrated with the company's platform, which spans Windows, Mac, mobile, and cloud environments, to enable a comprehensive understanding of attack flows.

It is reported that practical testing and reviews for adoption are currently underway, centered around investigative agencies, public institutions, and specialized digital forensics firms. CEO Kim Jong-kwang explained that expanded file system support and large-scale artifact analysis are necessary given the increasing proportion of security breaches in Linux servers and cloud environments, and stated his intention to further enhance capabilities by incorporating feedback from the field.