An analyst is investigating a Mac and wants to determine which applications were installed and when they were last used. Which files or databases would provide this information?

`/Applications` folder and `ls -la`

`~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2`

`~/Library/Application Support/`

A Linux server was breached. The attacker used stolen credentials to log in via SSH, then escalated privileges and ran commands. The investigator has the disk image and a memory dump. The attacker attempted to delete logs. Which evidence source is most likely to still contain traces of the attacker's commands?

The `/var/log/auth.log` file, even if partially deleted.

The `.bash_history` files of the compromised user.

The memory dump, which may contain command-line arguments and shell history from the attacker's sessions.

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 11)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 51–53

51application · medium
An analyst is investigating a Mac and wants to determine which applications were installed and when they were last used. Which files or databases would provide this information?
Select an answer first
52expert · hard
A Linux server was breached. The attacker used stolen credentials to log in via SSH, then escalated privileges and ran commands. The investigator has the disk image and a memory dump. The attacker attempted to delete logs. Which evidence source is most likely to still contain traces of the attacker's commands?
Select an answer first
53foundation · easy
During a Linux forensic investigation, which structure within the ext4 file system is primarily responsible for tracking which blocks are allocated to each file?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 11)

Questions 51–53

An analyst is investigating a Mac and wants to determine which applications were installed and when they were last used. Which files or databases would provide this information?

During a Linux forensic investigation, which structure within the ext4 file system is primarily responsible for tracking which blocks are allocated to each file?

Keep studying — Digital Forensics Investigations