During a security investigation, a suspicious Linux laptop is found in the server room. The laptop is processing information and indicating network…

The scenario describes the initial phase of a live system investigation on a suspicious Linux machine. The primary goal is to gather volatile data to understand current processes, user activity, and network connections without altering the system's state. The commands in option D are perfectly suited for this initial triage. lsof (list open files) and tcpdump (packet capture) directly investigate network activity. ps (process status) and who (logged-in users) identify running processes and user sessions. ifconfig details the network interface configuration, and ls allows for preliminary file system review. This collection of tools represents a standard, non-intrusive approach for live response.

A. iperf, traceroute, whois, ls, chown, cat

This option includes chown, which modifies file ownership and alters critical metadata, violating forensic principles for evidence preservation.

B. iperf, wget, traceroute, dc3dd, ls, whois

This set includes dc3dd for creating a forensic image, which is a later, more intrusive step, not part of an initial "what is happening" check. wget is for downloading files, not analysis.

C. lsof, chmod, nano, whois, chown, ls

This option is incorrect because it contains multiple commands (chmod, nano, chown) that actively modify the system's files and metadata, compromising evidence integrity.

---

1. NIST Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.2.1

"Collecting Data

" emphasizes the "order of volatility

" stating that investigators should capture the most volatile data first

such as network connections and running processes. The commands ps

lsof

ifconfig

and tcpdump from option D are standard tools for collecting this type of data from a live system.

2. SANS Institute

FOR508: Advanced Incident Response

Threat Hunting

and Digital Forensics Courseware. This industry-standard course teaches that initial live response on a Linux system involves commands to check processes (ps)

network status (netstat

ss

lsof

ifconfig)

and logged-on users (who

w). The tools in option D are a core part of this methodology for live data acquisition.

3. Carnegie Mellon University

Software Engineering Institute (SEI). "Incident Response: Live Response" In materials discussing live response procedures

the focus is on using system utilities to capture volatile state information. The document highlights the use of commands like ps

netstat (for which lsof and ifconfig are modern equivalents/complements)

and ls to understand the system's current state before taking more invasive actions like imaging. The commands in option D align directly with this guidance.