Discuss EC-Council 212-82 Exam Topic 17 Question 36

As a cybersecurity technician, you were assigned to analyze the file system of a Linux image captured from a device that has been attacked recently. Study the forensic image 'Evidenced.img" in the Documents folder of the "Attacker Machine-1" and identify a user from the image file. (Practical Question)

Asmith

Battacker

Croger

Djohn

Suggested Answer: B

The attacker is a user from the image file in the above scenario. A file system is a method or structure that organizes and stores files and data on a storage device, such as a hard disk, a flash drive, etc. A file system can have different types based on its format or features, such as FAT, NTFS, ext4, etc. A file system can be analyzed to extract various information, such as file names, sizes, dates, contents, etc. A Linux image is an image file that contains a copy or a snapshot of a Linux-based file system . A Linux image can be analyzed to extract various information about a Linux-based system or device . To analyze the file system of a Linux image captured from a device that has been attacked recently and identify a user from the image file, one has to follow these steps:

Navigate to Documents folder of Attacker Machine-1.

Right-click on Evidenced.img file and select Mount option.

Wait for the image file to be mounted and assigned a drive letter.

Open File Explorer and navigate to the mounted drive.

Open etc folder and open passwd file with a text editor.

Observe the user accounts listed in the file.

The user accounts listed in the file are:

root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-timesync:x:100: systemd-network:x: systemd-resolve:x: systemd-bus-proxy:x: syslog:x: _apt:x: messagebus:x: uuidd:x: lightdm:x: whoopsie:x: avahi-autoipd:x: avahi:x: dnsmasq:x: colord:x: speech-dispatcher:x: hplip:x: kernoops:x: saned:x: nm-openvpn:x: nm-openconnect:x: pulse:x: rtkit:x: sshd:x: attacker::1000

The user account that is not a system or service account is attacker, which is a user from the image file.

Get Premium 212-82 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

34 comments · newest first

Gwen 11 months ago

"john" could also be a possibility, just saying.

Fatima 11 months ago

Surprised to see "attacker" as an option, seems too obvious!

Raylene 11 months ago

I’m not so sure about that, could it be "roger" instead?

Dalene 12 months ago

Totally agree, "smith" seems like the right choice!

Alyce 12 months ago

I found the user "smith" in the file system.

An 1 year ago

I think I saw 'john' mentioned in one of our practice scenarios. It could be a trick question, though.

Jolanda 1 year ago

I’m a bit confused about the context of the attack. Would 'attacker' really be a valid user name?

Vi 1 year ago

This question feels similar to the one we did on user identification in class. I think it might be 'smith' since it’s a common username.

Meghan 1 year ago

I remember we practiced analyzing file systems, but I’m not sure how to extract user information from a forensic image.

Rolland 1 year ago

This is my time to shine! Forensics is my specialty. I'll methodically go through the file system, check common user locations, and see if I can find any clear evidence of a user account.

Joesph 1 year ago

Ugh, I hate these practical forensics questions. I'm better at the multiple-choice stuff. Let me think through this step-by-step and see if I can at least make an educated guess.

Dominga 1 year ago

Okay, I got this. I'll use tools like 'ls' and 'cat' to explore the file system and look for any user-related files or directories. Shouldn't be too hard to identify a user from there.

Charlena 1 year ago

Hmm, I'm not too familiar with Linux file system analysis. I'll need to review my notes on common Linux directory structures and user management files.

Gene 1 year ago

This seems like a straightforward forensics question. I'll start by examining the file system of the Linux image to look for any user accounts or login information.

Lazaro 1 year ago

Okay, let's see here. Provider Contract, Subtransaction, and Contract Account - those seem like the key fields I need to focus on.

Omega 1 year ago

I'm leaning towards option D because it talks about pulling information and formatting it for analysis, which seems like something we covered. But I'm not entirely sure if that fits "dual database."

Gene 2 years ago

Wow, this is a tough one. I'm going to go with A. 'smith'. It's the most normal-sounding name, so it's probably the most suspicious.

Nikita 2 years ago

↳ replying to Gene

I agree with you, 'smith' does sound like a normal name. Let's see if that's the right choice.

Rory 2 years ago

↳ replying to Gene

'john' seems like a pretty generic name, so I'm going with that one.

Adelina 2 years ago

↳ replying to Gene

I'm leaning towards 'roger'. It just seems like a common name that someone might use as a username.

Carmen 2 years ago

↳ replying to Gene

I think it might be 'attacker'. Sounds like a typical username for someone up to no good.

Pok 2 years ago

This question is a piece of cake! The answer is clearly B. 'attacker'. I mean, who else would have the guts to call themselves that, right?

Eulah 2 years ago

Hold on, I think it's D. 'john'. The most boring answer is usually the right one in these kinds of tests.

Alesia 2 years ago

I'm going with C. 'roger'. It's a classic hacker name, don't you think? Plus, it's not as obvious as 'attacker'.

Daren 2 years ago

↳ replying to Alesia

I see your point, but I'm sticking with C) roger. It just feels right to me.

Kindra 2 years ago

↳ replying to Alesia

I agree with you, I'll choose D) john. It seems like a plausible choice.

Lina 2 years ago

↳ replying to Alesia

I think I'll go with A) smith. It sounds like a common username.

Leslie 2 years ago

I think it's john, the file system points to that user.

Zack 2 years ago

I believe the user could be roger based on the evidence.

Rhea 2 years ago

I agree with Cassie, the user is most likely attacker.

Alesia 2 years ago

Definitely B. 'attacker' is the obvious choice here. It's like asking who the criminal is in a crime scene investigation.

Arlette 2 years ago

↳ replying to Alesia

Yeah, I agree. 'attacker' stands out as the most likely culprit in this case.

Lera 2 years ago

↳ replying to Alesia

I think it's B too. 'attacker' seems like the most suspicious user.

Cassie 2 years ago

I think the user might be attacker.

EC-Council 212-82 Exam - Topic 17 Question 36 Discussion