A Linux server was compromised, and the investigator needs to determine when a specific file was first created on the ext4 filesystem. The file's modification time has been altered by the attacker. Which forensic approach would provide the most reliable evidence of the file's original creation timeframe?

Recover the file from unallocated space and compare its data blocks

Check the file's access time (atime) from the current filesystem metadata

Review the system's syslog for any file creation events

Analyze the ext4 journal (jbd2) for the file's inode creation record

A Mac user is suspected of using a messaging app to exfiltrate data. The investigator has a full disk image and needs to find evidence of the app's usage, including messages and timestamps. Which approach would be most effective?

Only examine the unified logs for the app's process name.

Search the entire disk image for the app's name using `grep`.

Analyze the app's container directory under `~/Library/Containers/` for databases and plist files.

Only examine the `/Applications` folder for the app's presence.

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 4)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 16–20

16foundation · easy
Which Linux file contains the encrypted password hashes for user accounts and is readable only by privileged users?
Select an answer first
17application · medium
A Linux server was compromised, and the investigator needs to determine when a specific file was first created on the ext4 filesystem. The file's modification time has been altered by the attacker. Which forensic approach would provide the most reliable evidence of the file's original creation timeframe?
Select an answer first
18application · medium
A Mac was compromised, and the investigator needs to capture volatile data including running processes and network connections. The Mac is currently running. Which tool is most appropriate for this task?
Select an answer first
19expert · hard
A Mac user is suspected of using a messaging app to exfiltrate data. The investigator has a full disk image and needs to find evidence of the app's usage, including messages and timestamps. Which approach would be most effective?
Select an answer first
20foundation · easy
Which macOS command displays a list of running processes along with their process IDs and CPU usage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 4)

Questions 16–20

Which Linux file contains the encrypted password hashes for user accounts and is readable only by privileged users?

A Mac was compromised, and the investigator needs to capture volatile data including running processes and network connections. The Mac is currently running. Which tool is most appropriate for this task?

A Mac user is suspected of using a messaging app to exfiltrate data. The investigator has a full disk image and needs to find evidence of the app's usage, including messages and timestamps. Which approach would be most effective?

Which macOS command displays a list of running processes along with their process IDs and CPU usage?

Keep studying — Digital Forensics Investigations