Log4shell Investigate Based On Generic Computer Forensic Investigation Model

Log 4Shel1 (CVE-2021-44228) Vulnerability was disclosed on November 24, 2021. It is loophole from JAVA application which is a ubiquitous library of Log4j for logging framework. The hacker invokes JNDI lookup component for call Lightweight Directory Access Protocol (LDAP) which attacked by several ways such as Remote Code Execute (RCE) which is a critical effect on the vulnerable server. Therefore, this research paper proposes a study to investigate Log 4Shell under the control of the Generic Computer Forensic Investigation Model (GCFIM). The purpose of this investigation is to determine the management of the analysis process for accessing guideline information, gathering data, and analyzing digital evidence related to the Log4Shell attack. Furthermore, the paper provides a report documenting the source of the attacker that attacked the servers, which can be used as evidence in legal documents in court.