Linux and Mac Forensics CHFI Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When performing forensic analysis on a Linux system, you need to recover a file that was deleted from an ext4 filesystem. What is the most appropriate approach?

   • AUse a forensic tool like `extundelete` or `photorec` to scan the filesystem for remnants of the deleted file.
   • BCheck the system's Recycle Bin, which stores deleted files by default.
   • CReboot the system to restore the file from the kernel cache.
   • DUse the `rm` command with the `-r` flag to restore the file.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic analyst is investigating a macOS system that may have been used to launch a network attack. The analyst needs to identify which process initiated outbound connections. Which command or tool would be most effective?

   • Asystem_profiler SPNetworkDataType
   • Bps aux
   • Clsof -i
   • Dnetstat -an
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team is investigating a Linux server that was compromised. The attacker created a new user account and used it to establish an SSH connection. The team needs to determine the exact time of account creation and the source IP of the SSH connection. Which combination of evidence would provide the most reliable timeline?

   • AThe /etc/passwd file's modification time and the /var/log/auth.log entries
   • BThe /var/log/btmp file and the /var/log/wtmp file
   • CThe /etc/shadow file's modification time and the /var/log/syslog entries
   • DThe user's home directory creation time and the /var/log/messages entries
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A forensic investigator wants to review authentication-related events on a Linux system, such as successful and failed login attempts. Which log file is most likely to contain this information?

   • A/var/log/dmesg
   • B/var/log/kern.log
   • C/var/log/auth.log
   • D/var/log/syslog
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An investigator is reconstructing the actions of a macOS user who is suspected of exfiltrating data. The investigator has access to the user's Mac and needs to determine if any files were transferred via AirDrop or external storage. Which combination of artifacts would provide the most comprehensive evidence?

   • AUnified logs and the user's ~/Library/Preferences/com.apple.sharingd.plist
   • BThe system.log and the user's shell history
   • CThe /var/log/install.log and the user's Downloads folder
   • DThe Keychain and the user's Safari history
   Reveal Solution Discussion Select an answer first