# mlocate.db

### What is this artifact?

<https://www.signal-chief.com/wp-content/uploads/2021/01/Kali-Analysis.pdf>

mlocate.db contains file and directory metadata. When the utility *locate* is ran, it looks up the provided parameters in the mlocate database and returns matching entries. The mlocate.db is created and updated by updatedb. Updatedbs' configuration file is located at /etc/update.conf. When updatedb is ran, it will create a mlocate.db file if it doesn't exist or update it with any new information found in the system like new directories and files.

mlocate is similar to the locate utility (from GNU findutils), in that they both build an index of all files, except mlocate only lets the calling user see files that it could access.

### Where can it be found?

mlocate is compressed and located at:

* /var/lib/mlocate/mlocate.db
* /var/lib/plocate/plocate.db (GNU findutils)
* /var/lib/locate/locate.db (alternate to mlocate on kali linux)
* /var/cache/locate/locatedb
* **Updatedb**
  * /etc/update.conf

Find mlocate.db on any system:

```bash
locate --statistics
```

#### Locate vs Mlocate:

The [locate](http://packages.debian.org/) package is the implementation of [locate](https://en.wikipedia.org/wiki/Locate_\(Unix\)) from [GNU findutils](https://www.gnu.org/software/findutils/). The [mlocate](http://packages.debian.org/) package is another implementation of the same concept called [mlocate](http://carolina.mff.cuni.cz/~trmac/blog/mlocate).

{% embed url="<https://unix.stackexchange.com/questions/273182/difference-between-locate-and-mlocate>" %}

### What information does it contain?

* File names
* File Paths

#### Investigative Pro-Tips:

* Useful in identifying evidence of attacker tools and directories that may have been present.

#### Assumptions to be careful about:

* Just because a tool is not present, does not mean it did not exist. The database is not consistently updated and may not contain the data you're searching for.
* When looking on a live system, mlocate will build an index of all files but only lets the calling user see the files that it could access.

### Tools How To:

mlocate.db can be extracted and parsed with strings to then be searched with text editor.

```bash
#can use .strings instead of txt if oddly formatted.
strings /var/lib/mlocate/mlocate.db > /tmp/mlocate.txt
head -100 /tmp/mlocate.txt | grep \/

#Can manually update updatedb
dbupdate
```

### Misc

mlocate can be downloaded and parsed in order to better utilize a Local File Disclosure.

{% embed url="<https://www.ionize.com.au/post/taking-local-file-disclosure-to-the-next-level>" %}
