A forensic analyst is examining a Linux system and wants to determine the last commands executed in bash by the root user. Which artifact provides this information?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — the bash command history file for the root account is what you want because it records commands executed in root's bash session. You should remember attackers may clear or manipulate it, but it's still the primary artifact for recovering interactive command history.
Full Explanation
The bash command history file for the root account is correct because it records bash commands executed by the root user in their bash session; while attackers may clear or manipulate this file, it is the primary artifact for recovering interactive command history. The authentication log is wrong because it records authentication events such as logins and sudo usage, but not the actual commands typed after authentication. The system crontab is wrong because it records scheduled task definitions, not interactive command history. The kernel command line parameters are wrong because they show the kernel boot parameters, not user command history.