The Rootkit That Edits Files Only When You Read Them: A Linux Forensics Walkthrough
A Python file broke with an IndentationError on one Linux server only. The disk was fine; the kernel rewrote it on every read. A step-by-step course in proving it.
Read Article