A forensic analyst investigating a compromised Linux system finds the command history file has been cleared. Which alternative source BEST helps reconstruct attacker command activity?

D is correct because even with cleared command history, syslog and auth.log record authentication events, sudo commands, and some executed commands. The Linux audit daemon and shell timestamp files can help reconstruct the attacker's activity timeline. A is wrong because /etc/passwd shows user accounts but not command execution history. C is wrong because the ARP cache shows recent network communications, not commands executed on the system. B is wrong because /tmp may contain dropped tools but does not provide a command execution timeline.