312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ295

Tools/Systems/Programs

Evelyn, a forensic investigator, must analyze a Linux machine suspected of malicious activity. She needs to review open files and determine which processes are associated with them. Which Volatility Framework plugin should Evelyn use to list open files and their associated processes from a RAM image?

  • A linux.pslist
  • B linux.mount
  • C linux.lsof
  • D linux.malfind
Explanation

The linux.lsof plugin enumerates open file descriptors and reports them with their owning Linux processes, enabling open-file-to-process correlation from a memory image.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!