Linux Forensics Quiz

What type of data is "volatile data" in Linux forensics?

• Data that is stored permanently

• Data that is lost when power is turned off

• Data stored in log files

• Data accessible only by the root user

What is the purpose of collecting uptime data?

• To measure system storage capacity

• To determine the amount of time a system has been online

• To analyze user activity

• To locate root directories

Why is kernel information important in Linux forensics?

• It provides details on system uptime

• It contains system and configuration data critical for investigations

• It logs user activity

• It encrypts all user data

What command can be used to retrieve the hostname in Linux?

• hostname

• ls -a

• cat /etc/hostname

• sudo root

What file typically contains Linux log files?

• /usr/logs

• /etc/logs

• /var/log

• /home/log

In Linux, which file provides details about login attempts?

• /var/log/login

• /var/log/syslog

• /var/log/auth.log

• /etc/hosts

What is file signature analysis used for in forensics?

• To encrypt files

• To identify file types based on header data

• To recover lost files

• To analyze network activity

What tool is used for memory forensics in Linux?

• PhotoRec

• Recuva

• Autopsy

• ExifTool

Which file system is most commonly associated with Mac forensics?

• FAT32

• NTFS

• APFS

• EXT4

What is the purpose of Spotlight in Mac OS?

• To back up data

• To index files for faster searches

• To recover deleted files

• To run system updates