Linux and Mac Forensics ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic analyst needs to recover a file that was deleted from an APFS volume on a Mac. The Mac was shut down cleanly after the deletion. Which statement best describes the recovery outlook and the best approach?

   • ADeleted files are immediately overwritten by APFS snapshots, so recovery is impossible.
   • BRecovery is only possible if Time Machine was enabled before the deletion.
   • CThe file can be recovered by simply running `fsck_apfs` on the volume.
   • DAPFS uses copy-on-write, so deleted file data may still exist in free space; use a forensic tool that supports APFS to scan the volume image.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a live response on a compromised Linux host, an investigator needs to capture the state of running processes, network connections, and loaded kernel modules without altering the system more than necessary. Which tool is specifically designed for this type of memory and process acquisition?

   • A`LiME` (Linux Memory Extractor)
   • B`lsof` and `fuser`
   • C`foremost`
   • D`ps` and `netstat`
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A Linux system administrator suspects that an unauthorized user has been attempting to gain access via SSH. Which log file and specific entries would provide the most direct evidence of these attempts?

   • ALook at /var/log/kern.log for network interface status
   • BCheck /var/log/syslog for kernel messages about network connections
   • CReview /var/log/auth.log for 'Failed password' and 'Accepted password' entries
   • DExamine /var/log/dpkg.log for package installations
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An incident responder has captured a memory dump from a Linux server using LiME. The responder wants to extract a list of running processes and their command lines. Which tool is designed to analyze Linux memory dumps and extract this information?

   • A`foremost`
   • B`Volatility` with the appropriate Linux profile
   • C`grep` on the memory dump
   • D`strings` on the memory dump
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Mac forensic investigator needs to determine if a user accessed a specific external drive. The drive was formatted as APFS. Which artifacts would provide the most reliable evidence of this access?

   • AExamine the drive's APFS container superblock for access timestamps
   • BLook at the user's bash history for 'mount' commands
   • CReview the system's /var/log/system.log for disk I/O events
   • DCheck the system's unified logs for disk mount events and the user's ~/Library/Preferences/com.apple.finder.plist for recent mount points
   Reveal Solution Discussion Select an answer first