Linux and Mac Forensics ECSS Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   During a Linux incident response, you need to determine if a specific process was running at the time of the incident. The system has been rebooted since the incident. Which source of evidence would be most useful?

   • AReview the system's syslog for process start events
   • BCheck the system's current process list with 'ps aux'
   • CAnalyze a memory dump that was captured during the incident
   • DExamine the filesystem for the process's executable file
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A Linux server is suspected of running a rootkit that hides processes. The investigator has a memory dump and a disk image. The investigator wants to identify hidden processes. Which approach is most effective?

   • AAnalyze only the `/var/log/auth.log` for login events.
   • BCompare the process list from `ps` (if captured live) with the process list extracted from the memory dump using Volatility.
   • CSearch the disk image for process names using `grep`.
   • DRun `chkrootkit` on the disk image.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A Linux server was compromised. The attacker deleted logs, modified user accounts, and attempted to hide files. The investigator has a forensic image of the disk. The investigator needs to build a timeline of activity. Which combination of artifacts would provide the most comprehensive timeline?

   • AOnly the `.bash_history` files from all users.
   • BOnly the `/etc/passwd` and `/etc/shadow` file timestamps.
   • CFilesystem timestamps (MAC times) from the ext4 image, the ext4 journal, and `/var/log/auth.log` if present.
   • DOnly the `/var/log/syslog` file.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An investigator is analyzing a Mac system to determine if a user accessed a specific file on a USB drive. The system uses unified logging. Which command would be most effective in finding evidence of this access?

   • Acat /var/log/system.log
   • Bdefaults read com.apple.finder RecentFolders
   • Cls -la /Volumes/USBDrive
   • Dlog show --predicate 'eventMessage CONTAINS "USB drive name"' --info --debug
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An investigator is examining a Mac system to determine which applications a user has installed and when they were first used. Which combination of artifacts would provide the most comprehensive evidence?

   • ACheck the system's unified logs for application installation events
   • BLook at the user's ~/Library/Logs folder for application logs
   • CReview the /Applications folder and the user's ~/Library/Preferences/*.plist files
   • DExamine the user's ~/Library/Application Support folder
   Reveal Solution Discussion Select an answer first