Features of Creating Accounts in Linux OS

Currently, operating systems based on the Linux kernel and open-source software are widely used, including: Debian, Centos, openSUSE, RedHat, Slackware and others, all distributions of which include the kernel and open-source software (packages). This allows you to organize user interaction with various devices. The article presents the results of an analysis of the creation of user account files for operating systems based on the Linux kernel. We are considering using the grep utility to search for data on the hard drive. In operating system forensics, all possible behavior patterns of such source code are very important. Of particular interest are user account management processes and their traces in operating systems. The forensic application of the found methods for controlling user accounts is considered, which will increase the level of information security of the system. A theory will be put forward about the origin of the phenomenon of duplication of account file records on the hard drive, which assumes that duplication occurs due to the characteristics of the file system and the operation of the useradd utility. An experiment was conducted to confirm the theory and show the stages of creating duplicate account files, which allows you to track all changes in the account manipulation system, regardless of system logs.