An investigator needs to recover a file that was recently deleted from a Mac system using APFS. The user had FileVault enabled. What is the most important consideration for the recovery attempt?

APFS snapshots may contain the deleted file if a local Time Machine snapshot exists

FileVault encryption prevents any recovery of deleted files

The file can be recovered from the HFS+ journal if the system was upgraded from HFS+

The file can be recovered from the Trash folder in the user's home directory

A forensic analyst is investigating a Linux system suspected of running a memory-resident malware. The malware is not visible in the filesystem. Which action would be most effective in identifying the malicious process?

Capture a memory dump and analyze it with Volatility to list processes and network connections

Search the filesystem for suspicious executable files

Check the system's cron jobs for scheduled malicious tasks

Run 'ps aux' on the live system to list all running processes

A forensic analyst is investigating a Mac system to determine if a user installed a specific application. Which combination of artifacts would provide the most reliable evidence of the installation?

Look at the system's /var/log/install.log for package installation records

Review the user's bash history for 'brew install' or 'sudo installer' commands

Check the /Applications folder for the app bundle and review the unified logs for installation events

Examine the user's ~/Library/Preferences for the app's plist file

A Linux server was breached. The investigator has a forensic image of the disk and a memory dump. The attacker is suspected of creating a new user account and using it to run a malicious process. The system's auth.log has been partially cleared. Which combination of evidence would provide the most reliable reconstruction of the attacker's actions?

Use the memory dump to extract the attacker's command history from the shell process

Analyze the memory dump for the malicious process and its parent process, and correlate with the ext4 journal for file creation events

Rely solely on the remaining auth.log entries to trace the user account creation and login

Examine the /etc/passwd and /etc/shadow files for the new user account and its creation timestamp

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 6)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 26–30

26application · medium
An investigator needs to recover a file that was recently deleted from a Mac system using APFS. The user had FileVault enabled. What is the most important consideration for the recovery attempt?
Select an answer first
27application · medium
A forensic analyst is investigating a Linux system suspected of running a memory-resident malware. The malware is not visible in the filesystem. Which action would be most effective in identifying the malicious process?
Select an answer first
28application · medium
A forensic analyst is investigating a Mac system to determine if a user installed a specific application. Which combination of artifacts would provide the most reliable evidence of the installation?
Select an answer first
29application · medium
An investigator is analyzing a Mac's unified logs to determine if a specific USB device was connected. Which log subsystem or process would most likely contain this information?
Select an answer first
30expert · hard
A Linux server was breached. The investigator has a forensic image of the disk and a memory dump. The attacker is suspected of creating a new user account and using it to run a malicious process. The system's auth.log has been partially cleared. Which combination of evidence would provide the most reliable reconstruction of the attacker's actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 6)

Questions 26–30

An investigator needs to recover a file that was recently deleted from a Mac system using APFS. The user had FileVault enabled. What is the most important consideration for the recovery attempt?

A forensic analyst is investigating a Linux system suspected of running a memory-resident malware. The malware is not visible in the filesystem. Which action would be most effective in identifying the malicious process?

A forensic analyst is investigating a Mac system to determine if a user installed a specific application. Which combination of artifacts would provide the most reliable evidence of the installation?

An investigator is analyzing a Mac's unified logs to determine if a specific USB device was connected. Which log subsystem or process would most likely contain this information?

Keep studying — Digital Forensics Investigations