performance medium Apply forensics-timeline 2 points

Question 36. CSCD240-E1-B

List the 5 most recently modified files in /tmp (newest first).

Work the drill

Answer on paper or in a terminal before revealing the ideal answer.

Ideal answer

ls -lt /tmp | head -6

Acceptable alternatives: ["ls -lt /tmp | head -n 6", "find /tmp -maxdepth 1 -printf \"%T@ %p\\n\" | sort -rn | head -5"]

Misconception bank

Each row below is a plausible wrong answer, the thinking that produces it, and the remedy that corrects the misconception. These are the foundation of the multiple-choice framing and the targeted feedback a student receives after answering.

ls /tmp | head -5

Misconception. Alphabetical, not time-sorted.

Remedy. -lt flag sorts by mtime; -lrt reverses.

Authority mappings

Hover any chip for the mapping justification; click to open the authority record.

DCWF roles: EN-211 Forensics Analyst

DCWF tasks: T0447

KU outcomes: CO-O5-O2

O*NET tasks: SOC 15-1212.00: task 6 SOC 15-1212.00: task 7

NCAE errors: SMB Login / failure: SMB operation failed: [Errno.SSH Login / failure: Failed to connect to host: IPSMB Login / failure: SMB operation failed: [Errno.SMB Login / failure: SMB connection failed: proto.SSH Login / partial: The following users failed t.SSH Login / partial: The following users failed t.