A forensic analyst is examining a Linux system and wants to determine the last commands executed in bash by the root user. Which artifact provides this information?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because /root/.bash_history records bash commands executed by the root user in their bash session; while attackers may clear or manipulate this file, it is the primary artifact for recovering interactive command history. A is wrong because auth.log records authentication events (logins, sudo usage) but not the actual commands typed after authentication.
Full explanation below image
Full Explanation
B is correct because /root/.bash_history records bash commands executed by the root user in their bash session; while attackers may clear or manipulate this file, it is the primary artifact for recovering interactive command history. A is wrong because auth.log records authentication events (logins, sudo usage) but not the actual commands typed after authentication. C is wrong because crontab records scheduled task definitions, not interactive command history. D is wrong because /proc/cmdline shows the kernel boot parameters, not user command history.