An IR analyst is performing triage on a potentially compromised Linux web server. Which command sequence collects volatile artifacts in the correct order of volatility?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because it follows the order of volatility (RFC 3227): running processes (ps aux) → network connections (netstat -anp) → process memory maps (/proc) → login history (last) → recently modified files (find -mtime). A is wrong because /etc/passwd and log files are non-volatile and should be collected after volatile data.
Full explanation below image
Full Explanation
B is correct because it follows the order of volatility (RFC 3227): running processes (ps aux) → network connections (netstat -anp) → process memory maps (/proc) → login history (last) → recently modified files (find -mtime). A is wrong because /etc/passwd and log files are non-volatile and should be collected after volatile data. C is wrong because mounting and copying disk data ignores volatile state entirely. D is wrong because stopping services, deleting files, and rebooting destroys critical forensic evidence.