During a forensic investigation of a Linux system, an analyst needs to quickly identify which user accounts were recently added and when the system was last rebooted. Which two files should the analyst examine to gather this information?

Review /etc/group for group memberships and /var/log/syslog for system messages.

Inspect /etc/passwd for user accounts and /var/log/boot.log for boot events.

Examine /etc/shadow for password hashes and /var/log/auth.log for authentication attempts.

Check /etc/passwd for user accounts and /var/log/wtmp for login records.

A user accidentally deleted an important document from an ext4 filesystem on a Linux workstation. The investigator needs to recover the file. Which approach is most likely to succeed?

Use `grep` to search the raw device for the file content while it is still mounted.

Run `fsck` on the filesystem to repair and recover the file.

Immediately unmount the filesystem and use `extundelete` on the device.

Copy the file from the system's trash folder.

During a forensic examination, an investigator finds a file with unusual permissions and ownership. The investigator needs to determine if the file was recently modified and by whom. Which combination of commands would provide the most useful information?

`cat` the file and `grep` for keywords

`stat` on the file and `ls -l` on the parent directory

`chmod` and `chown` to reset permissions

`file` and `md5sum` on the file

An investigator is analyzing a Linux system that was used to host a web server. The investigator needs to find the web server's configuration files, logs, and any uploaded content. The system uses standard directory conventions. Which directories should be examined?

/etc/nginx/, /var/log/nginx/, and /var/www/

/usr/share/, /var/cache/, and /opt/

EC-CouncilDigital Forensics Essentials

Domain 4Objective 4

Linux Memory and File System Analysis DFE Practice Questions (Page 10)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

50questions here

10free pages

10concepts

Questions 46–50

46application · medium
During a forensic investigation of a Linux system, an analyst needs to quickly identify which user accounts were recently added and when the system was last rebooted. Which two files should the analyst examine to gather this information?
Select an answer first
47application · medium
A user accidentally deleted an important document from an ext4 filesystem on a Linux workstation. The investigator needs to recover the file. Which approach is most likely to succeed?
Select an answer first
48foundation · easy
Which of the following is a dedicated tool specifically designed for capturing volatile memory from a Linux system?
Select an answer first
49expert · medium
During a forensic examination, an investigator finds a file with unusual permissions and ownership. The investigator needs to determine if the file was recently modified and by whom. Which combination of commands would provide the most useful information?
Select an answer first
50expert · medium
An investigator is analyzing a Linux system that was used to host a web server. The investigator needs to find the web server's configuration files, logs, and any uploaded content. The system uses standard directory conventions. Which directories should be examined?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.