A forensic examiner is investigating a macOS system and needs to determine if FileVault was enabled and when the system was last unlocked. Which artifacts should be examined?

Check /etc/fstab and /var/log/system.log

Check /Library/Preferences/com.apple.security.plist and the system.log

Check the Keychain and the user's login history

Check the output of `fdesetup status` and the unified log for unlock events

During a forensic examination of a Linux system, an investigator needs to recover a deleted file that was stored in the /home/user directory. The file system is ext4 and the system has been powered off. Which approach is most likely to recover the deleted file?

Copy the entire disk to another drive and then use Windows recovery software.

Boot the system and use the 'undelete' command in the file manager.

Run the grep command on the raw disk device to search for the file's content.

Use the debugfs command on a bit-for-bit image of the disk to locate and extract the deleted inode.

A forensic examiner is investigating a Linux system where an attacker is suspected of adding a user to the sudo group. Which files and logs should be examined to confirm this?

/etc/shadow and /var/log/lastlog

/etc/passwd and /var/log/syslog

/etc/group and /var/log/auth.log

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 2

Linux and Mac Forensics CHFI Practice Questions (Page 3)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

31questions here

7free pages

12concepts

Questions 11–15

11application · medium
A forensic examiner is investigating a macOS system and needs to determine if FileVault was enabled and when the system was last unlocked. Which artifacts should be examined?
Select an answer first
12application · medium
A Linux administrator notices a suspicious process running on a server. The administrator needs to determine which executable file the process is running from. Which command would provide this information?
Select an answer first
13application · medium
During a forensic examination of a Linux system, an investigator needs to recover a deleted file that was stored in the /home/user directory. The file system is ext4 and the system has been powered off. Which approach is most likely to recover the deleted file?
Select an answer first
14application · medium
A forensic examiner is investigating a Linux system where an attacker is suspected of adding a user to the sudo group. Which files and logs should be examined to confirm this?
Select an answer first
15application · easy
A Linux system administrator suspects that an unauthorized user account was created on a server. Which file should be examined first to confirm the existence of the account and its UID?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Linux and Mac Forensics CHFI Practice Questions (Page 3)

Questions 11–15

A forensic examiner is investigating a macOS system and needs to determine if FileVault was enabled and when the system was last unlocked. Which artifacts should be examined?

A Linux administrator notices a suspicious process running on a server. The administrator needs to determine which executable file the process is running from. Which command would provide this information?

During a forensic examination of a Linux system, an investigator needs to recover a deleted file that was stored in the /home/user directory. The file system is ext4 and the system has been powered off. Which approach is most likely to recover the deleted file?

A forensic examiner is investigating a Linux system where an attacker is suspected of adding a user to the sudo group. Which files and logs should be examined to confirm this?

A Linux system administrator suspects that an unauthorized user account was created on a server. Which file should be examined first to confirm the existence of the account and its UID?

Keep studying — Operating System Forensics