312-49V11 · Question #99
Mateo, a forensic investigator, is analyzing a cyber-attack carried out against a target organization. During his investigation, he discovers that several important files are missing on a Linux…
The correct answer is C. cp /proc/$PID/exe /tmp/file. According to the CHFI v11 objectives under Operating System Forensics, Linux Memory and Process Analysis, and Anti-Forensics Techniques, attackers sometimes use a technique where a malicious executable deletes or overwrites itself after execution to evade detection. Although…
Question
Mateo, a forensic investigator, is analyzing a cyber-attack carried out against a target organization. During his investigation, he discovers that several important files are missing on a Linux system. Further examination reveals that one of the files, which was an executable, had erased its own content during the attack. Mateo realizes that in order to recover this file, he needs to use a Linux command that can help him retrieve the contents of this erased executable. Given the situation, which of the following commands should Mateo use to recover the lost executable file on the Linux system?
Options
- Acd C:\RECYCLER\S-<User SID>
- BD<#>.
- Ccp /proc/$PID/exe /tmp/file
- D$R<#>.
How the community answered
(53 responses)- A4% (2)
- B6% (3)
- C79% (42)
- D11% (6)
Explanation
According to the CHFI v11 objectives under Operating System Forensics, Linux Memory and Process Analysis, and Anti-Forensics Techniques, attackers sometimes use a technique where a malicious executable deletes or overwrites itself after execution to evade detection. Although the file may be erased from disk, if the process is still running, Linux maintains a reference to the executable in memory through the /proc filesystem. Each running process in Linux has a directory under /proc/<PID>/, and the symbolic link /proc/<PID>/exe points to the executable image currently loaded into memory. By copying this link using the command: cp /proc/$PID/exe /tmp/file an investigator can successfully recover the in-memory version of the executable, even if it has been deleted from disk. This is a well-documented forensic technique in CHFI v11 for recovering malware binaries and analyzing fileless or self-deleting malware.
Topics
Community Discussion
No community discussion yet for this question.