QuestionQ38
Logs and Network ForensicsSophia, a forensic analyst, is examining event log files on a compromised server. During her investigation, she finds an unusual entry in the event log header. The entry’s ELF_LOGFILE_HEADER value shows that records have been written to the log, but the event log file was not properly closed. Based on this information, which ELF_LOGFILE_HEADER value would Sophia identify?
- A ELF_LOGFILE_HEADER_DIRTY0x0001
- B ELF_LOGFILE_ARCHIVE_SET0x0008
- C ELF_LOGFILE_HEADER_WRAP0x0002
- D ELF_LOGFILE_LOGFULL_WRITTEN0x0004
Community Discussion