Which command is commonly used to capture the contents of physical memory (RAM) from a Linux system for forensic analysis?

cat /var/log/messages > memdump.img

An analyst is investigating a Linux server that was compromised. The attacker installed a rootkit that hides processes and network connections. The analyst needs to identify the rootkit and understand its persistence mechanism. Which approach should the analyst take?

Analyze the memory dump with Volatility's linux_psxview and linux_malfind plugins.

Review /var/log/auth.log for unusual login events and /var/log/syslog for system messages.

Check /etc/rc.local and /etc/init.d/ for suspicious startup scripts.

Compare process lists from /proc and `ps` to identify hidden processes.

An analyst is investigating a Linux system where an attacker used the command line to perform malicious actions. The analyst needs to reconstruct the exact commands the attacker executed. Which sources should the analyst examine to recover this information?

Review /var/log/auth.log for command execution logs.

Analyze the memory dump with Volatility's linux_bash plugin.

Examine both the .bash_history file and the memory dump with Volatility's linux_bash plugin.

Check the .bash_history file in the attacker's home directory.

EC-CouncilDigital Forensics Essentials

Domain 4Objective 4

Linux Memory and File System Analysis DFE Practice Questions (Page 7)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

50questions here

10free pages

10concepts

Questions 31–35

31foundation · easy
Where are password hashes for user accounts stored on modern Linux systems?
Select an answer first
32foundation · easy
Which command is commonly used to capture the contents of physical memory (RAM) from a Linux system for forensic analysis?
Select an answer first
33foundation · easy
Which command is used to display active network connections, listening ports, and routing tables on a Linux system?
Select an answer first
34expert · hard
An analyst is investigating a Linux server that was compromised. The attacker installed a rootkit that hides processes and network connections. The analyst needs to identify the rootkit and understand its persistence mechanism. Which approach should the analyst take?
Select an answer first
35application · medium
An analyst is investigating a Linux system where an attacker used the command line to perform malicious actions. The analyst needs to reconstruct the exact commands the attacker executed. Which sources should the analyst examine to recover this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Linux Memory and File System Analysis DFE Practice Questions (Page 7)

Questions 31–35

Where are password hashes for user accounts stored on modern Linux systems?

Which command is commonly used to capture the contents of physical memory (RAM) from a Linux system for forensic analysis?

Which command is used to display active network connections, listening ports, and routing tables on a Linux system?

An analyst is investigating a Linux server that was compromised. The attacker installed a rootkit that hides processes and network connections. The analyst needs to identify the rootkit and understand its persistence mechanism. Which approach should the analyst take?

An analyst is investigating a Linux system where an attacker used the command line to perform malicious actions. The analyst needs to reconstruct the exact commands the attacker executed. Which sources should the analyst examine to recover this information?

Keep studying — Operating System Forensics