Valid Digital-Forensics-in-Cybersecurity Dumps shared by ExamDiscuss.com for Helping Passing Digital-Forensics-in-Cybersecurity Exam! ExamDiscuss.com now offer the newest Digital-Forensics-in-Cybersecurity exam dumps, the ExamDiscuss.com Digital-Forensics-in-Cybersecurity exam questions have been updated and answers have been corrected get the newest ExamDiscuss.com Digital-Forensics-in-Cybersecurity dumps with Test Engine here:
A forensic examiner is reviewing a laptop running OS X which has been compromised. The examiner wants to know if any shell commands were executed by any of the accounts. Which log file or folder should be reviewed?
Correct Answer: B
Comprehensive and Detailed Explanation From Exact Extract: The.bash_historyfile located in each user's home directory (e.g.,/Users/<user>/.bash_history) records the history of shell commands entered by the user in bash shell sessions. Reviewing this file allows investigators to see the commands executed by a specific user. * /var/vmcontains virtual memory swap files, not command history. * /var/logcontains system logs but not individual user shell command history. * /Users/<user>/Library/Preferencesstores application preferences. NIST guidelines and macOS forensics literature confirm.bash_historyas the standard location for shell command histories on OS X systems.
