An IR analyst is performing triage on a potentially compromised Linux web server. Which command sequence collects volatile artifacts in the correct order of volatility?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because it follows the order of volatility (RFC 3227): running processes (ps aux) → network connections (netstat -anp) → process memory maps (/proc) → login history (last) → recently modified files (find -mtime). A is wrong because /etc/passwd and log files are non-volatile and should be collected after volatile data.
Full Explanation
B is correct because it follows the order of volatility (RFC 3227): running processes (ps aux) → network connections (netstat -anp) → process memory maps (/proc) → login history (last) → recently modified files (find -mtime). A is wrong because /etc/passwd and log files are non-volatile and should be collected after volatile data. C is wrong because mounting and copying disk data ignores volatile state entirely. D is wrong because stopping services, deleting files, and rebooting destroys critical forensic evidence.