multiple_choice
easy
Remember
forensics
2 points
Question 1. CSCD240-E1-C
Which command returns inode, permission bits, size, and all three timestamps of a file?
Work the drill
Answer on paper or in a terminal before revealing the ideal answer.
Ideal answer
C: stat
Misconception bank
Each row below is a plausible wrong answer, the thinking that produces it, and the remedy that corrects the misconception. These are the foundation of the multiple-choice framing and the targeted feedback a student receives after answering.
A: ls -l
Misconception. ls -l shows size and one timestamp (mtime) but no inode or octal.
Remedy. Compare stat vs ls -l outputs side-by-side.
B: file
Misconception. file identifies data type, not metadata.
Remedy. Demo file vs stat: different tools.
D: find
Misconception. find locates files by name/attributes but does not report metadata directly.
Remedy. find -printf can approximate but stat is canonical.
Authority mappings
Hover any chip for the mapping justification; click to open the authority record.
DCWF roles:
EN-211 Forensics Analyst
DCWF tasks:
T0447
KU outcomes:
CO-O5-O2
Course-artifact links
Lectures
- CSCD240-S26-L03. Files, directories, file command, wildcards, viewing
CTF challenges
- 02 Permissions: The Full Dossier