A forensic analyst investigating a compromised Linux system finds the command history file has been cleared. Which alternative source BEST helps reconstruct attacker command activity?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — even when the command history is gone, you can still reconstruct activity from syslog, authentication logs, shell timestamp files, and audit daemon logs. Those sources record logins, sudo use, and some executed commands. The other artifacts don't give you a command timeline.
Full Explanation
The best source is syslog and authentication logs combined with any partially intact shell timestamp files and audit daemon logs, because even when command history has been cleared, syslog and auth.log can record authentication events, sudo commands, and some executed commands. The Linux audit daemon and shell timestamp files can help reconstruct the attacker's activity timeline. The /etc/passwd file containing user account information is wrong because it shows user accounts but not command execution history. The system ARP cache showing recent network communications is wrong because it shows recent network communications, not commands executed on the system. The /tmp directory contents which may contain dropped tools is wrong because /tmp may contain dropped tools but does not provide a command execution timeline.