Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Linux > Commands > Flashcards

Commands Flashcards

1
Q

lsblk

A

list disks and partitions attached to system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What command can be used to display mounted devices and paritions

A

lsblk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What commands can be used to create or list partitions

A

fdisk -l <dev>
gdisk -l <dev></dev></dev>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

fdisk -l

A

list partitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

gdisk

A

likes GPT partitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

su -

A

switch user to root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

uname

A

identify kernel version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

sudo

A

use root for one specific command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What commands can be used to identify hard ware

A

lspci
lsusb
usb-devices

-v (verbose)
-k (expanded output)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

cat <file></file>

A

stream contents of file to terminal/shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What commands can be used to identify USB serial number

A

lsusb -v
usb-devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

man <command></command>

A

user manual / information on the command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What commands can be used to identify disk information

A

lsscsi (does not show partitions)
file -s
fdisk - l </dev/>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the order of commands to use to identify a device, partition, and file system

A

lsblk = mounted devices
fdisk -l <> = partition information
file -s <> = file system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

lsscsi

A

list the scsi partitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

file -s </dev/sdaX>

A

identify the file system of a device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

dmesg

A

device messages / information about a device received directly from kernel

can contain serial number, model, date/time connected/disconnected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what is the /bin folder

A

binary folder which contains standard commands like ls, cd, pwd, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what is the /boot folder

A

contains files needed at bool (LILO or GRUB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is the /dev folder

A

files that represent devices on a system (device nodes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is the /etc folder

A

contains administrative configuration files and scrips

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what is the /home folder

A

user home directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what is the /lib folder

A

32bit software libraries (program files)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what is the /lib64 folder

A

64bit software libraries (program filesx64)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what is the /media folder

A

udisks mount points / standard place to mount system removable media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

what is the /mnt folder

A

temporary mount points for external, remote, removeable file systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what is the /opt folder

A

folder for optional software files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what is the /sbin folder

A

administrative commands (fdisk, ifconfig, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

what is the /usr folder

A

contains local software, libraries, and user specific installer files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what is the /var folder

A

contains logs and other variable files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

what is the /run directory

A

contains dynamic run files for system daemons like udev and udisks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

mount

A

manually mount a specific device

example:

mount -t <file> -o <option> <device> <mountpoint></mountpoint></device></option></file>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

what command can be used to unmount a mount point

A

umount

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

what does the /etc/fstab file contain

A

file system table of device, mountpoint, file system type, and default options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the userspace command to mount / unmount a device

A

udiskctl mount
udiskctl unmount

-b (specifies block device to mount)

will mount under /run/media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

grep < pattern > < filename >

A

search for occurrences of the pattern within the file name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

find <start directory <criteria></criteria>

A

searches for files based on criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

what is this find command looking for

find /etc -iname fstab

A

find, starting in the /etc directory, a filename fstab (case insensitive)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

file

A

categorizes files based on a file signature comparison (to magic files)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

ps

A

list current running processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

strings

A

prints out readable characters from a file

used to search data files and extract useful strings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

chmod

A

change permissions on a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

chown

A

change owner (and group) of a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

what information is outputted for ls -l

A

file type (. - regular file, d-directory, b-block device, c-character device, l-link)

permissions (owner, group, others)

user

group

size in bytes

date modified

filename

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What does > do

A

output to a file (stdout)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What does&raquo_space; do

A

append to a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What does 2> do

A

output error messages (stderr)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

bc

A

basic calculator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Explain the command:

echo “scale =2”; 5/3” | bc

A

Divide 5/3 with decimal place of 2

Output: 1.66

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

explain the command:

echo “ibase=16;4C | bc”

A

calculate the hex to decimal value of 4C

output = 76

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is a base shell arithmetic expansion

A

echo $((Calculation))

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Explain the command:

echo $((0x4c-70))

A

Calculate the hex to decimal value of 4C (76) and subtract 70

Output = 6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What file stores the history of a bash shell

A

.bash_history

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

vi

A

virtual editor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What are the edit modes in vi

A

i = insert
a= append
o=open a new line under current line
0 = open a new line above current line

56
Q

Explain the following commands in vi

0-
$-
x-
X-
dd-
y-
p-
P-
:wq
:w
:q!
:wq!
:w fname
/string

A

0-move cursor to beginning of line
$-move cursor to end of line
x-delete character under the cursor
X-delete the character before the cursor
dd- delete the entire line the cursor is on
y-yank/copy
p-paste after the cursor
P-paste before the cursor
:wq- save and quit
:w- save and continue editing
:q! - quit and discard changes
:wq! - save and quit without prompt
:w - save as filename
/string - search for strings\

57
Q

What file controls the init program

A

/etc/inittab

58
Q

What does /etc/profile contain

A

global bash initialization file for login shells

59
Q

What is a runlevel

A

A description of a system state (shutdown, single user mode, reboot, graphical login) for BSD startup

60
Q

what does the /.bash_profile contain

A

used by bash to load configuration for login shell for each user

61
Q

what does the /.bashrc contain?

A

used by bash to load configuration for non-login shells

62
Q

What files are used to control access to the linux system

A

/etc/hosts.deny
/etc/hosts.allow

63
Q

iptables

A

used to block network traffic at physical network interface (IP level)

64
Q

what command is used in Slackware for package management

A

slackpkg

65
Q

Explain compiling from source

A

distribution agnostic
can tailor to your specific environment
without careful manipulation, the executables and libraries placed in less than optimal locations
can be difficult to manage upgrade paths or remembering what has been installed

66
Q

tar

A

used to extract/create tar archives

67
Q

make

A

used to create an install package

68
Q

Explain distribution packages

A

package manager
handles the work of adding and removing software packages from your system

69
Q

wget

A

download files from website

70
Q

sbotools

A

install and building software on slackware

71
Q

sbointsall

A

install a package (and is dependencies)

72
Q

hdparm -I /dev/sdd

A

used to identify hard drive detailed information

73
Q

md5sum <file></file>

A

calculates md5 hash

74
Q

sha1sum <file></file>

A

calculate sha1sum

75
Q

explain the following command:

dd if=/dev/sdd of=/path/image.raw bs=512

A

using dd, image /dev/sdd to file image.raw with block size 512

76
Q

what is conv=noerror,sync when used with dd

A

pass copying sectors with errors and pad those sectors with zeros

77
Q

How can you split a raw image

A

split <file> <output></output></file>

-d (output file uses numerical numbers)
-aN (suffix length and N= length of characters i.e. a3 for .001)
-bXG (treat input as binary and line are ignored, XG=size in GB i.e. 4GB)

78
Q

How can you use cat to merge split image files

A

cat image.raw.* > image.raw.new

79
Q

What are the command line imaging tools used

A

dd
dc3dd
ewfacquire
ddrescue

80
Q

Explain the following command:

dc3dd if=/dev/sdc hofs=dc3dd.raw ofsz=512M hash=sha1 hash=md5 log=dc3dd.log

A

hof = hash of input, output

ofs = split output file

hofs = hashes and splits

ofsz = output file size
hash = algorithm
log=FILEname for logfile
hlog = write hash log of image and any split files to the log file

81
Q

ewfacquire

example: ewfacquire -C “2019-001” -d sha1 -D “thumb drive seized from bad buy” -e “Barry Grundy” -E “2019-001-002” -m removable -M physical -S 512M -t case.disk2 -u /dev/sdb

A

acquire a specific device (forensic image) with added features of adding metadata into E01 files

82
Q

ewfinfo

A

reads the metadata that was entered during the imaging process

83
Q

ewfverify

A

hashes the forensic image file / allows to verify against original media

84
Q

ewfexport

ewfexport -t < file> -f raw -u < file>.E01

A

take an ewf file and convert it to bit stream image file (raw file)

-t(target) - to write a file
-f - file format
-u - accept remaining defaults / run unsupervise

85
Q

ddrescue

ddrescue /dev/sdb ddres_image.raw ddress.map.txt
ddrescue <device> <extracted> <map file></extracted></device>

A

when there are errors in disk when creating an image (conv=noerror,sync) this can use a map file to recreate

will read the healthy portions of a disk first then fall back to recovery mode, trying to read data from bad sectors, allowing ddrescue to resume any imaging job given a map file (of bad sectors) to work off of

86
Q

what does tar tzvf < file> do

A

tar command will extract a zip

t-list
z-decompress
v-
f-file
x-extract

87
Q

what command would you use to listen for a netcat command on port 2525 and output to a raw file

A

nc -l -p 2525 | dd of=/mnt/vidence/net.dd.raw

88
Q

Explain what this command is doing:

dd if=/dev/sda | nc 192.168.0.1 2525

A

Pipes the output of dd command of /dev/sda to the IP address through port 2525

89
Q

What does ewfacquirestream do

A

similar to ewfacwuire but through a netcat / stream command

example: nc -l -p 2524 | ewfacquirestream -M physical -t / mnt/evidence/net_ewfstream

90
Q

What are these flags for ewfacquirestream

-C
-D
-e
-E
-f
-m
-M
-N
-t

A

-C=case number
-D=description
-e=examiner
-E=evidence number
-f=encase format (-f encase6)
-m=media type
-M=media flags
-N=notes
-t=target path and file name

91
Q

What does gzip do

A

compresses and decompresses files

-c compress
-d decompress

92
Q

What commands can be used to wipe /dev/sda with block size 4kb chunks

A

dd if=/dev/zero of=/dev/sda bs=4k

dc3dd wipe=/dev/sdb

93
Q

What commands can be used to check to see if a wipe was complete

A

xxd -a /dev/sda

-a = autoskip option to find next character

dc3dd hwipe=/dev/sda hash=sha1

94
Q

What steps can you take to mount an image

A
  1. identify structure (fdisk -l, mmls)
  2. identify the file system (file -s)
  3. Mount using mount or loop (mount -t <> -o ro,loop <image> <location>, losetup /dev/loop0 <image>)</image></location></image>
  4. If using losetup, mount to directory (mount /dev/loop0p1 /mnt/tmp)
  5. unmount (umount , losetup -d)
95
Q

Explain this command:

mount -t vfat -o ro,loop fat_fs.raw /mnt/analysis

A

mounting fat_fs.raw to the mount location /mnt/analysis with read only permissions and file structure of ‘vfat’ using loop device to mount thf file system within the image

96
Q

What command can be used to loop a mount device

A

losetup /dev/sda <image></image>

97
Q

What command resulted in this output:

Disk NTFS_Pract_2017.raw: 500 MiB, 524288000 bytes, 1024000 sectors
Units: sectors of 1 *512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xe8dd21ee
Device Boot Start End Sectors Size Id Type
NTFS_Pract_2017.raw1 2048 1023999 1021952 499M 7 HPFS/NTFS/exFAT

A

fdisk -l NFTS_Pract_2017.raw

98
Q

What is the offset starting sector and respective bytes

Units: sectors of 1 *512 = 512 bytes
Device Boot Start End Sectors Size Id Type
NTFS_Pract_2017.raw1 2048 1023999 1021952 499M 7 HPFS/NTFS/exFAT

A

2048, (2048*512)

99
Q

What command would be used to mount the partition

Units: sectors of 1 *512 = 512 bytes
Device Boot Start End Sectors Size Id Type
NTFS_Pract_2017.raw1 2048 1023999 1021952 499M 7 HPFS/NTFS/exFAT

A

mount -o ro,loop,offset=1048576 NTFS_Pract_2017.raw /mnt/tmp

losetup -o $((2048512)) –sizelimit
$((1021952512))/dev/loop0 NTFS_Pract_2017.raw

100
Q

What does the flag -P mean for losetup

what about -r and -f

A

automatically maps partitions to separate loop devices

-r = read only
-f = find first available loop device

101
Q

What command can be used to mount a split image

A

affuse <image> <mount></mount></image>

example: affuse able3.000 /mnt/aff

102
Q

What is the unmount command for affuse

A

fusermount -u /mnt/aff

103
Q

What ewf command can be used to mount an imag

A

ewfmount

ewfmount NTFS_Pract_2017.E01 /mnt/ewf

104
Q

Explain how to mount an ewf image

A

Using fdisk -l, we see the structure of the image.

We use losetup -P with the read-only
option (-r), find the first available loop device (-f) to add the loop mapping for the partition.

We use the the file command with the (-s) option to confirm the file system type. In this case we see it is NTFS.

Finally we mount the volume with the mount command using the ntfs-3g22 file system driver (-t ntfs-3g).

105
Q

Explain this command:

grep -abif analysis/searchlist.txt fat_fs.raw >
analysis/hits.txt

A

searching using grep through fat_fs.raw for any phrases in searchlist.txt and output results to hits.txt

-a = process file as text
-b=provide byte offset of hit
-i=ignore upper and lower case
-f=read file in for search terms

106
Q

Explain the command:

xxd -s 1261479 fat_fs.raw | head -n 5

A

display top 5 lines for hex view of fat_fs.raw starting at byte offset 1261479

107
Q

What does the awk command do

A

allows files to be displayed as columns based on delimiter

example: awk ’{print $1” “$2}’

108
Q

What are the steps taken to carve a file using dd

A
  1. Find the start of the JPEG (xxd and grep)
    - xxd image_carve_2017.raw | grep ffd8
    (location 36AC0)
    - echo “ibase=16;36AC0” | bc
  2. Find the end of the JPEG (xxd and grep)
    - xxd -s 223942 image_carve_2017.raw | grep ffd9 (location 0005D3C6)
    -echo “ibase=16;0005D3C6” | bc
  3. Calculate the size of the JPEG in bytes (bc)
    -echo “381906-223942” | bc (157964)
  4. Cut from the calculated start - the calculated number of bytes and output to a file (dd)
    -dd if=image_carve_2017.raw of=carved.jpg bs=1 skip=223942 count=157964
109
Q

Describe how to carve a partition using dd

A
  1. fdisk -l < image > to find the offset
    - starts at 2048, number of sectors 102400
  2. use dd to extract using start and total sectors
    dd if=able_3.raw of=able_3.part1.raw bs=512 skip=2048
    count=102400
110
Q

What commands will help identify file system layer

A

file
fsstat
fls

111
Q

What commands will help identify physical device layer

A

lshw
lsscsi
hdparm

112
Q

What commands will help identify media layer

A

fdisk
gdisk
file -s
mmls
mmcat
mmstat

113
Q

What commands will help identify the metadata (inode) layer

A

icat
ils
ifind
istat

114
Q

What commands will help identify content/data layer

A

blkcalc
blkcat
blkls
blkstat

115
Q

mmls

A

provides partition table and offsets

similar to fdisk and gdisk

116
Q

fsstat

A

gather file system information

example: fsstat -o 2048 <image></image>

117
Q

fls

A

list file names and directories contained in directory or specific metadata identifier

example: fls -o 10260 able2.dd 2

118
Q

Explain the command

fls -o 10260 -Frd able2.dd

A

displays directory information against the partition in able2.dd starting at sector offset 10260 (-o 10260), showing only file entries (-F), descending into directories recursively (-r), and displaying deleted (unallocated) entries (-d).

  • asterisk listed before the node means it is deleted/unallocated
119
Q

ffind

A

find all file names associated with particular metadata entry by using the ffind command

example: ffind -o 10260 -a able2.dd 2139

120
Q

Explain command:

ffind -o 10260 -a able2.dd 2139

A

find all entries for offset / partition at 10260 that are associated with metadata id /inode 2139

-a=get all nodes associated with inode

121
Q

istat

A

gather file information on inode, data blocks can be used to extract data using icati

example: istat -o 10260 able2.dd 2139

122
Q

icat

A

stream contents from inode to a file

example: icat -o 10260 able2.dd 2139 > lrkn.tgz.2139

123
Q

Explain the command:

icat -o 10260 able2.dd 11108 | file -

A

stream contents from partition starting at offset 10260 all data blocks associated with inode 11108 and result of contents is run through file to identify the file type

124
Q

Explain the order of identifying information from an image using TSK

A
  1. mmls (get offset information
  2. fsstat -o (get file system information)
  3. fls -o <offset> -r < image> (file directories / inodes)</offset>
  4. istat -o <offset> <image> < node ></image></offset>
  5. icat -o <offset> <image> < node> | xxd or file -</image></offset>
125
Q

Explain the command

grep -abi cybernetik able2.dd

A

Search for phrase cybernetik to get case insensitive results with the byte offset and treating the .dd file as a text file

126
Q

Explain how to find file based on grep results

A
  1. Search grep
  2. use resulting byte to calculate sector (echo “10561603/512” | bc = 20628)
  3. mmls to find what partition the sector is located in (10260)
  4. find offset of partition in sectors (echo “10260*512” | bc=5253120)
  5. find volume offset (echo “10561603-5253120” | bc =5308483)
  6. ffstat to get information file system (fsstat -o 10260 able2.dd)
  7. find data block (echo “5308483/1024” | bc=5184)
  8. get block data for the block (blkstat -o 10260 able2.dd 5184)
  9. find which inode consists of that block (ifind -o 10260 -d 5184 able2.dd)
  10. identify file information for file in that inode (istat -o 10260 able2.dd 10090)
  11. stream contents of file (icat -o 10260 able2.dd 10090 | less)
127
Q

blkls

A

list all data blocks unallocated

-e = copy every block

128
Q

Explain the command

blkls -o 10260 able2.dd > able2.blkls

A

in the partition starting at offset 10260 extract all unallocated blocks to file .blkls

129
Q

blkcalc

A

blkcalc with the -u option to specify that we want to calculate the block address from an extracted unallocated image

example: blkcalc -o 10260 -u 1593 able2.dd

130
Q

Explain the command

blkstat -o 10260 able2.dd 5184

A

output for block 5184 in the original image to determine if it is unallocated, fragmented

131
Q

What command would you use to find an inode based on a block

A

ifind

example: ifind -o 10260 -d 5184 able2.dd
output: 10090

istat -o 10260 able2.dd 10090

132
Q

What is a difference between examining FAT and NTFS file systems in TSK

A

NTFS file system allows for alternate data streams (ADS)

Example:
39-128-1
39-128-3

133
Q

bulk_extractor

A

used to identify particular features from a set of data

134
Q

photorec

A
135
Q

scalpel

A

file carving tool

Linux (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions