A forensic examiner is analyzing an ext4 filesystem image from a compromised Linux server. The examiner wants to identify recently modified files that may indicate malicious activity. Which artifact or structure within the ext4 filesystem would provide the most useful timeline of file changes?

The `.bash_history` files of all users

During a forensic investigation of a Linux system, you need to determine if a user account was created by an attacker and whether that account was used to gain root privileges. Which combination of evidence sources would be most effective?

Review the /var/log/syslog for kernel messages and system startup events

Analyze the system's memory dump for running processes and open files

Check the bash history of the root user and the system's crontab

Examine /etc/passwd and /etc/shadow for account creation, and review auth.log for sudo or su usage

A forensic analyst is investigating a Linux system where an attacker is suspected of modifying user accounts. The analyst wants to determine if any accounts have been added or modified recently. Which files should be examined for timestamps and content?

`/etc/group` and `/etc/gshadow`

`/etc/hosts` and `/etc/hostname`

`/etc/passwd` and `/etc/shadow`

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 5)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 21–25

21application · medium
A forensic examiner is analyzing an ext4 filesystem image from a compromised Linux server. The examiner wants to identify recently modified files that may indicate malicious activity. Which artifact or structure within the ext4 filesystem would provide the most useful timeline of file changes?
Select an answer first
22application · medium
During a forensic investigation of a Linux system, you need to determine if a user account was created by an attacker and whether that account was used to gain root privileges. Which combination of evidence sources would be most effective?
Select an answer first
23foundation · easy
In modern macOS, which logging system consolidates log data from various system components and applications into a single unified store?
Select an answer first
24application · medium
A forensic analyst is investigating a Linux system where an attacker is suspected of modifying user accounts. The analyst wants to determine if any accounts have been added or modified recently. Which files should be examined for timestamps and content?
Select an answer first
25foundation · easy
Which Linux log file is the primary location for general system activity messages, such as service start/stop events and application errors?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 5)

Questions 21–25

A forensic examiner is analyzing an ext4 filesystem image from a compromised Linux server. The examiner wants to identify recently modified files that may indicate malicious activity. Which artifact or structure within the ext4 filesystem would provide the most useful timeline of file changes?

During a forensic investigation of a Linux system, you need to determine if a user account was created by an attacker and whether that account was used to gain root privileges. Which combination of evidence sources would be most effective?

In modern macOS, which logging system consolidates log data from various system components and applications into a single unified store?

A forensic analyst is investigating a Linux system where an attacker is suspected of modifying user accounts. The analyst wants to determine if any accounts have been added or modified recently. Which files should be examined for timestamps and content?

Which Linux log file is the primary location for general system activity messages, such as service start/stop events and application errors?

Keep studying — Digital Forensics Investigations