210-255 · Question #176
Refer to the exhibit. Which event is represented by this configuration?
The correct answer is B. A drive is being mounted using ext3-test.img file as a source.. The exhibit shows a Linux mount command using a disk image file as its source, attaching the image's filesystem to a local directory for access.
Question
Refer to the exhibit. Which event is represented by this configuration?
Exhibit
Options
- AThe ext3-test.img is being converted from read-only to read-write for analysis.
- BA drive is being mounted using ext3-test.img file as a source.
- CA /mnt/test directory is being created in the ext3-test.img file.
- DThe ext3-test.img file was found on the ext4 filesystem in the /mnt/test directory.
How the community answered
(42 responses)- A12% (5)
- B79% (33)
- C2% (1)
- D7% (3)
Why each option
The exhibit shows a Linux mount command using a disk image file as its source, attaching the image's filesystem to a local directory for access.
The mount command attaches a filesystem to a directory and does not modify file permissions or change the access mode of the image file itself from read-only to read-write.
The Linux 'mount' command with the loop device option mounts a disk image file such as ext3-test.img as though it were a physical block device, making its contents accessible at a mount point like /mnt/test. This technique is standard in digital forensics to examine disk images non-destructively without altering the original evidence. The 'ext3' label in the filename indicates the filesystem type contained within the image being mounted.
The mount command mounts the image file to an already-existing directory on the host system; it does not create a directory inside the image file.
The ext3-test.img file is the source being mounted onto /mnt/test, not a file discovered within that directory; the ext3 label refers to the internal filesystem type of the image, not the host filesystem.
Concept tested: Mounting disk image files for forensic analysis
Source: https://linux.die.net/man/8/mount
Topics
Community Discussion
No community discussion yet for this question.
