Which of the following would be used in forensic analysis of a compromised Linux system? (Select THREE).

Reviewing log files for logins from unauthorized IPs directly identifies potential attacker access points and is a standard first step in forensic investigation of a compromised system.

/proc/kmem provides raw access to kernel memory addresses and is not used to examine fragmented memory segments during standard forensic analysis.

/etc/shadow stores salted cryptographic password hashes, not unencrypted passwords, making this statement technically incorrect and not a valid forensic check.

Checking file timestamps for modifications near the time of compromise helps identify altered, added, or deleted files that may indicate attacker activity or installed persistence mechanisms.

lsof lists files currently opened by running processes and does not report or filter by file timestamps - the find command with time-based parameters is the correct tool for that purpose.

Encrypting compromised data files with gpg would alter the evidence and violate forensic chain-of-custody integrity principles, making it inappropriate during an active investigation.

Verifying MD5 checksums of system binaries against known-good baseline values detects rootkits and trojanized binaries that attackers commonly replace to maintain covert access.

vmstat reports virtual memory statistics and CPU activity and is not a forensic tool suited for identifying indicators of compromise on a Linux system.