Linux Memory and File System Analysis DFE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A forensic examiner is reconstructing the actions of a user on a Linux system. The user's `.bash_history` file has been cleared. The examiner needs to find other sources of command history. Which approach is most likely to yield useful evidence?

   • AExamine the system's audit logs (e.g., auditd) for command executions.
   • BUse `grep` on the raw disk to find command strings.
   • CLook in /var/log/auth.log for shell sessions.
   • DCheck /var/log/syslog for command lines.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is examining a Linux file system image and needs to determine when a specific file was last accessed, modified, and when its metadata was last changed. The analyst also needs to identify the file's original owner. Which command should the analyst use to gather all this information?

   • ARun `find` with the -printf option to display only the modification time.
   • BUse `ls -la` on the file to view permissions, ownership, and modification time.
   • CRun `stat` on the file to display all timestamps, permissions, and ownership.
   • DExecute `file` on the file to determine its type and last modified date.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A forensic analyst is examining a Linux file system image and needs to determine the exact timeline of when a file was created, modified, and accessed. The file system is ext4 and the analyst has a raw image. Which tool should the analyst use to extract the most accurate timeline information?

   • AUse `stat` on the file to display all timestamps.
   • BUse `fls` and `istat` from The Sleuth Kit to examine the file system metadata.
   • CUse `extundelete` to recover the file and then use `stat` to view timestamps.
   • DUse `debugfs` to examine the inode and extract timestamps.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is reviewing a Linux server's logs after a suspected brute-force attack on SSH. The analyst needs to identify the source IP addresses that attempted authentication and whether any succeeded. Which log file and command should the analyst use?

   • AExamine /var/log/syslog and run `grep sshd` to find SSH daemon messages.
   • BReview /var/log/auth.log and run `grep sshd` to find SSH authentication attempts.
   • CCheck /var/log/secure and run `grep ssh` to find SSH connection attempts.
   • DLook at /var/log/messages and run `grep sshd` to find SSH daemon messages.
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   An investigator is examining a file on a Linux filesystem and needs to determine when the file's content was last modified, when its metadata was last changed, and when it was last accessed. Which command provides all three timestamps?

   • A`ls -l /path/to/file`
   • B`file /path/to/file`
   • C`stat /path/to/file`
   • D`cat /path/to/file`
   Reveal Solution Discussion Select an answer first