312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ179

Logs and Network Forensics

While investigating a suspected data breach at a multinational corporation, forensic investigators have seized several devices for analysis, including Windows PCs, Linux servers, and Android smartphones. A few Mac computers have also been identified as possible evidence sources for gaining comprehensive insight into the activities preceding the breach.

Which of the following methods is most effective for viewing log messages on Mac devices?

  • A Using the Terminal application to navigate to the /var/log directory and examining log files such as system.log and secure.log.
  • B Accessing the Event Viewer utility in the Control Panel to retrieve system logs and security event records.
  • C Installing third-party forensic software specifically designed for Mac systems, offering advanced log analysis capabilities and visualization tools.
  • D Employing the Windows Subsystem for Linux (WSL) to run Linux-based log analysis tools, enabling seamless integration with Mac systems.
Explanation

macOS supports direct examination of log files from Terminal, including the legacy system log at /private/var/log/system.log. This native file-system approach is the applicable option for retrieving and reviewing Mac log data; Event Viewer and WSL are Windows-specific, while unspecified third-party software is not required for basic log access. Apple also provides the Console app for viewing collected log messages.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!