Useful Linux Commands (Linux Forensics Analyst, DevOps Engineer, System Administrator) Flashcards
What command repeatedly outputs a string until interrupted?
yes
What is the purpose of the ‘yes’ command?
To automatically provide a repeated response, commonly ‘y’, to prompts.
Which command displays text in an ASCII speech bubble spoken by a cow?
cowsay
What command can be used to print text as if spoken by an ASCII cow?
cowsay
What command reverses the characters of a string?
rev
How can you reverse the characters in ‘linux’ using a Linux command?
echo ‘linux’ | rev
What happens when you run ‘sl’ instead of ‘ls’ by mistake?
It shows an animation of a steam locomotive.
Which command shows a steam locomotive animation if typed incorrectly?
sl
Which command builds and executes command lines from input?
xargs
How do you remove all .txt files using ‘find’ and ‘xargs’?
find . -name ‘*.txt’ | xargs rm
What cryptic-looking command can crash a system by creating infinite processes?
Fork bomb: :(){ :|:& };:
What is the purpose of the ‘factor’ command?
To output the prime factors of a given number.
What command displays the prime factors of a number?
factor
Which command executes another command repeatedly at specified intervals?
watch
How do you display disk usage (df) every 2 seconds using ‘watch’?
watch -n 2 df -h
Which command displays a file in reverse line order?
tac
How do you reverse the line order of a file using a Linux command?
tac filename.txt
Which command shuffles the lines of input randomly?
shuf
What command is used to shuffle the lines in a text file randomly?
shuf mylist.txt
What does the ‘pv’ command do?
Monitors the progress of data through a pipe.
Which command allows you to monitor the progress of a file being copied?
pv
What does the ‘dd’ command do?
Converts and copies files in raw byte form.
How do you copy disk images using ‘dd’?
dd if=/dev/sda of=/dev/sdb bs=64K
What is the function of the ‘mkfifo’ command?
Creates a named pipe (FIFO).
What command creates a named pipe in Linux?
mkfifo
Which command adds line numbers to text?
nl
How do you add line numbers to a text file?
nl file.txt
What command displays how long the system has been running?
uptime
What is the purpose of the ‘uptime’ command?
To display how long the system has been running and load averages.
Which command displays random quotes or proverbs?
fortune
What does the ‘fortune’ command do?
Displays random quotes, jokes, or proverbs.
Which command pauses execution for a set amount of time?
sleep
How do you pause a script for 5 seconds in Linux?
sleep 5
Which command outputs the contents of a gzip-compressed file without decompressing it?
zcat
What command allows you to view compressed files without decompressing them?
zcat
Which command translates or deletes characters in text?
tr
How do you replace spaces with newlines using a Linux command?
echo ‘hello world’ | tr ‘ ‘ ‘\n’
What is the purpose of the ‘tput’ command?
To manipulate terminal settings, such as colors or cursor movement.
Which command changes text color to red in a terminal?
tput setaf 1
Which command displays detailed information about a file, including metadata such as last access and modification times?
stat
How can you view the detailed metadata of a file in Linux?
stat filename
Which command is used to show the running processes in Linux?
ps
How do you view a list of all running processes in Linux?
ps aux
Which command can show open network connections, listening ports, and other network-related information?
netstat
What command lists all open network connections and listening ports on a Linux system?
netstat -tulnp
Which command shows active network connections and related stats, replacing ‘netstat’ in modern systems?
ss
How do you view active TCP connections using the ‘ss’ command?
ss -t
Which command lists all open files and the processes that opened them?
lsof
How do you check which files are open by which processes in Linux?
lsof
What command can be used to monitor changes to files and directories in real-time?
inotifywait
How do you monitor changes in a directory in real-time in Linux?
inotifywait -m /path/to/directory
Which command is used to create a cryptographic hash (checksum) of a file for integrity verification?
sha256sum
How do you generate the SHA-256 hash of a file in Linux?
sha256sum filename
Which command captures all traffic on a network interface and displays it for analysis?
tcpdump
How do you capture network traffic on interface eth0 and write it to a file using tcpdump?
tcpdump -i eth0 -w capture.pcap
Which command is used to analyze packet captures (PCAP files) from tools like tcpdump?
wireshark
How can you visually analyze a pcap file in Linux?
wireshark filename.pcap
What command is used to securely erase files by overwriting them multiple times?
shred
How do you securely delete a file in Linux using ‘shred’?
shred -u filename
Which command provides a forensic timeline of file access, modification, and creation times?
sleuthkit ‘fls’
How do you create a forensic timeline from an image file using ‘fls’?
fls -r imagefile.img
Which command allows forensic investigators to extract data from memory dumps?
volatility
How can you analyze a memory dump for processes using Volatility?
volatility -f memory.dmp –profile=Win7SP1x64 pslist
Which command provides detailed information about the usage of disk space by files and directories?
du
How do you check the disk usage of a specific directory?
du -sh /path/to/directory
What tool allows the recovery of deleted files from an ext3 or ext4 file system?
extundelete
How do you recover deleted files from a partition using extundelete?
extundelete /dev/sda1 –restore-all
Which command displays information about USB devices connected to the system?
lsusb
How do you view a list of USB devices connected to the system?
lsusb
What command lists all the block devices connected to the system?
lsblk
How do you list all block devices (like hard drives) in Linux?
lsblk
Which command provides a hexadecimal and ASCII dump of a file’s content, often used in forensics for low-level data inspection?
hexdump
How do you display the hexadecimal contents of a file in Linux?
hexdump filename
Which command is used to create a binary image of an entire drive for forensic analysis?
dd
How do you create a raw disk image of a drive using ‘dd’?
dd if=/dev/sda of=/path/to/output.img bs=64K
Which command is used to examine the attributes of ext2, ext3, and ext4 file systems?
debugfs
How do you open an ext4 filesystem for analysis using ‘debugfs’?
debugfs /dev/sda1
