An IR analyst is performing triage on a potentially compromised Linux web server. Which command sequence collects volatile artifacts in the correct order of volatility?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want the sequence that grabs volatile stuff first: running processes, network connections, process memory maps, login history, then recently modified files. That's the order of volatility, so you don't blow away evidence before you capture it.
Full Explanation
The correct sequence is the one that starts with ps aux, then netstat -anp, then cat /proc/[pid]/maps, then last, then find / -mtime -1, because it follows the order of volatility (RFC 3227): running processes (ps aux) -> network connections (netstat -anp) -> process memory maps (/proc) -> login history (last) -> recently modified files (find -mtime). The sequence using cat /etc/passwd; ls /var/log; df -h is wrong because /etc/passwd and log files are non-volatile and should be collected after volatile data. The sequence using mount /dev/sda1 /mnt; rsync -av /mnt /backup is wrong because mounting and copying disk data ignores volatile state entirely. The sequence using systemctl stop apache2; rm -rf /tmp/*; reboot is wrong because stopping services, deleting files, and rebooting destroys critical forensic evidence.