nerdexam
Cisco

210-255 · Question #176

Refer to the exhibit. Which event is represented by this configuration?

The correct answer is B. A drive is being mounted using ext3-test.img file as a source.. The exhibit shows a Linux mount command using a disk image file as its source, attaching the image's filesystem to a local directory for access.

Host-Based Analysis

Question

Refer to the exhibit. Which event is represented by this configuration?

Exhibit

210-255 question #176 exhibit

Options

  • AThe ext3-test.img is being converted from read-only to read-write for analysis.
  • BA drive is being mounted using ext3-test.img file as a source.
  • CA /mnt/test directory is being created in the ext3-test.img file.
  • DThe ext3-test.img file was found on the ext4 filesystem in the /mnt/test directory.

How the community answered

(42 responses)
  • A
    12% (5)
  • B
    79% (33)
  • C
    2% (1)
  • D
    7% (3)

Why each option

The exhibit shows a Linux mount command using a disk image file as its source, attaching the image's filesystem to a local directory for access.

AThe ext3-test.img is being converted from read-only to read-write for analysis.

The mount command attaches a filesystem to a directory and does not modify file permissions or change the access mode of the image file itself from read-only to read-write.

BA drive is being mounted using ext3-test.img file as a source.Correct

The Linux 'mount' command with the loop device option mounts a disk image file such as ext3-test.img as though it were a physical block device, making its contents accessible at a mount point like /mnt/test. This technique is standard in digital forensics to examine disk images non-destructively without altering the original evidence. The 'ext3' label in the filename indicates the filesystem type contained within the image being mounted.

CA /mnt/test directory is being created in the ext3-test.img file.

The mount command mounts the image file to an already-existing directory on the host system; it does not create a directory inside the image file.

DThe ext3-test.img file was found on the ext4 filesystem in the /mnt/test directory.

The ext3-test.img file is the source being mounted onto /mnt/test, not a file discovered within that directory; the ext3 label refers to the internal filesystem type of the image, not the host filesystem.

Concept tested: Mounting disk image files for forensic analysis

Source: https://linux.die.net/man/8/mount

Topics

#Linux mount command#disk imaging#file system forensics#evidence acquisition

Community Discussion

No community discussion yet for this question.

Full 210-255 Practice