A Mac system was compromised. The investigator has a full disk image and a memory dump. The attacker is suspected of using a legitimate application to exfiltrate data. The user's ~/Library/Preferences/com.apple.finder.plist has been modified. Which approach would provide the most reliable evidence of the exfiltration activity?

Examine the modified Finder plist for recent file access records

Review the user's bash history for commands related to file transfer

Correlate the unified logs for network connections and file access events with the memory dump to identify the process and its network activity

Analyze the APFS snapshots to recover the files that were accessed

During a Linux forensic investigation, you need to recover a deleted file from an ext4 filesystem. The file was deleted recently, and the system has been powered off since the deletion. Which approach would be most likely to recover the file?

Analyze the system's memory dump for the file contents

Check the system's trash folder for the deleted file

Use a forensic tool like extundelete or PhotoRec on a bit-for-bit image of the filesystem

Boot the system and run 'grep' on the raw disk device to find the file contents

A Mac was used to browse the internet, and the investigator needs to recover the browsing history. Which file or database would contain this information?

`~/Library/Caches/com.apple.Safari/`

`~/Library/Preferences/com.apple.Safari.plist`

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 2)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 6–10

6expert · hard
A Mac system was compromised. The investigator has a full disk image and a memory dump. The attacker is suspected of using a legitimate application to exfiltrate data. The user's ~/Library/Preferences/com.apple.finder.plist has been modified. Which approach would provide the most reliable evidence of the exfiltration activity?
Select an answer first
7foundation · easy
In Linux, which file stores user account information, including user IDs and home directories?
Select an answer first
8application · medium
During a Linux forensic investigation, you need to recover a deleted file from an ext4 filesystem. The file was deleted recently, and the system has been powered off since the deletion. Which approach would be most likely to recover the file?
Select an answer first
9application · medium
A Mac was used to browse the internet, and the investigator needs to recover the browsing history. Which file or database would contain this information?
Select an answer first
10foundation · easy
Which command-line utility is used to query the unified log system on modern macOS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 2)

Questions 6–10

In Linux, which file stores user account information, including user IDs and home directories?

During a Linux forensic investigation, you need to recover a deleted file from an ext4 filesystem. The file was deleted recently, and the system has been powered off since the deletion. Which approach would be most likely to recover the file?

A Mac was used to browse the internet, and the investigator needs to recover the browsing history. Which file or database would contain this information?

Which command-line utility is used to query the unified log system on modern macOS?

Keep studying — Digital Forensics Investigations