312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

Liam, a digital forensic investigator, is analyzing evidence from a cyberattack that targeted a Linux-based system. During his analysis, he finds that several files are missing. On further examination, he observes that a particular executable file, which was running at the time of the attack, erased its own contents, making recovery more difficult. To retrieve the lost file, Liam must identify the correct Linux command that would help recover it. Which of the following commands should Liam use to recover the lost file on the Linux system?

A cp /proc/$PID/exe /tmp/file
B cd C:\RECYCLER\S-..User SID
C D<#>.
D $R<#>.

Explanation

In Linux, /proc/<PID>/exe is a procfs link to a process’s executable. While the process remains running, copying /proc/$PID/exe to a safe location can recover the executable image. The Linux kernel documentation identifies the exe entry as the link to the executable of that process.

Learn more

The /proc Filesystem — Linux Kernel documentation

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ2

Community Discussion