<![CDATA[Purpose – This study applies the National Institute of Standards and Technology Special Publication (NIST SP 800-86) framework to investigate SSH authentication logs from the Lensa UNISA Server while preserving evidence integrity and enriching forensic findings using GeoIP and Autonomous System Number (ASN) information.Methods – The investigation followed the Collection, Examination, Analysis, and Reporting phases of NIST SP 800-86. The auth.log.1 file was acquired using Secure Copy Protocol (SCP), verified through SHA-256 hashing, and analyzed using standard Linux utilities. GeoIP and ASN information was obtained using MaxMind GeoLite2 and RDAP.Findings – SHA-256 verification confirmed identical hashes between the original evidence and working copy. The analysis identified 96,182 OpenSSH-related events, including 15,522 failed authentication attempts, 4,604 invalid-user messages, and eight successful sessions. Systematic username enumeration targeting institutional account names was observed. GeoIP and ASN enrichment showed that substantial authentication activity originated from source IP addresses in the Netherlands and Turkey, particularly AS43350, AS48090, and AS154383, consistent with activity associated with hosting infrastructure.Research Implications – The findings demonstrate the practical applicability of NIST SP 800-86 for SSH log investigation using standard Linux tools. GeoIP and ASN enrichment provide additional context for interpreting authentication artifacts.Originality – This study presents an operational forensic case study integrating NIST SP 800-86, Linux-based log analysis, and GeoIP–ASN enrichment]]>
Copyrights © 2026
