Examine the image below. Which of the following directories should be examined for suspicious entries?

The correct answer is C. hidden. The directory hidden has two hidden entries, a zero-byte file called " " (space) and a second 136 byte file called "." Both of these files should be investigated and are considered to be suspicious. The stealthy directory is empty and the tmp directory is a regular tmp…

Incident Response & Cyber Kill Chain

Question

Exhibit

Options

Astealthy
Btmp
Chidden

How the community answered

(27 responses)

A
11% (3)
B
4% (1)
C
85% (23)

Explanation

The directory hidden has two hidden entries, a zero-byte file called " " (space) and a second 136 byte file called "." Both of these files should be investigated and are considered to be suspicious. The stealthy directory is empty and the tmp directory is a regular tmp directory from an OS X client. The " ." (space+dot) directory should not exist but it is otherwise empty.

Topics

#hidden directories#file system forensics#suspicious entries#rootkit detection

Community Discussion

No community discussion yet for this question.

Full GCIH Practice