A Linux administrator needs to analyze a compromised disk for traces of malware. To complete the analysis, the administrator wants to make an exact, block-level copy of the disk. Which of the…

The correct answer is D. dd if=/dev/sdc of=/tmp/image bs=8192. The dd command performs a low-level, block-by-block copy of a device. Using if=/dev/sdc (input file) and of=/tmp/image (output file) with a block size (bs) ensures an exact replica of the disk, suitable for forensic analysis.

Security

Question

A Linux administrator needs to analyze a compromised disk for traces of malware. To complete the analysis, the administrator wants to make an exact, block-level copy of the disk. Which of the following commands accomplishes this task?

Options

Acp -rp /dev/sdc/* /tmp/image
Bcpio -i /dev/sdc -ov /tmp/image
Ctar cvzf /tmp/image /dev/sdc
Ddd if=/dev/sdc of=/tmp/image bs=8192

How the community answered

(25 responses)

A
4% (1)
D
96% (24)

Explanation

The dd command performs a low-level, block-by-block copy of a device. Using if=/dev/sdc (input file) and of=/tmp/image (output file) with a block size (bs) ensures an exact replica of the disk, suitable for forensic analysis.

Topics

#dd command#disk imaging#forensics#block-level copy

Community Discussion

No community discussion yet for this question.

Full XK0-006 Practice