CHFI OS and Network Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Systemd service

  Why it's wrong here

  Systemd services are managed through unit files with a .service extension, stored under /etc/systemd/system or /lib/systemd/system. While they are a common mechanism for starting persistent daemons or processes at boot, they are not appropriate for scheduling recurring tasks such as the one found in this investigation. The presence of an entry in /etc/cron.d would be characteristic of a cron job, not a systemd service, and systemd units would typically have distinct configuration keys like ExecStart or Restart. Even if a systemd timer could mimic cron's behavior, a .service unit alone does not define a schedule.

• ✗

  Init script

  Why it's wrong here

  Init scripts, located in /etc/init.d/, are legacy SysV init shell scripts that start and stop services during system boot or runlevel changes. They are executed once when the system transitions to a runlevel, not on a recurring schedule. Finding a file in /etc/cron.d is not an init script, as those scripts usually have names matching a service and are symlinked into /etc/rc*.d. The presence of a cron entry with a time specification clearly points to cron, not an init script, which lacks the syntax for defining periodic execution intervals.

• ✓

  Cron job

  Why this is correct

  Cron jobs are defined in /etc/cron.d, /etc/crontab, or a user's crontab and are executed by the cron daemon according to a schedule specified with time fields (minute, hour, day of month, month, day of week). A file in /etc/cron.d is a standard location for system cron jobs, and the syntax often includes the user account to run the job as well as the command. This matches the scenario where a file found during a Linux forensic investigation is executed on a schedule, making cron the correct classification. The five-field time specification is a unique characteristic that distinguishes cron from systemd services or init scripts.

• ✗

  At job

  Why it's wrong here

  At jobs, defined with the at command and stored in /var/spool/cron/atjobs or /var/spool/at, are used to execute a command once at a specific future time, not on a recurring schedule. Unlike cron jobs, at jobs do not use time fields that specify periodic intervals; they instead use a daemon that waits until the scheduled exact time and then runs the job. A file in /etc/cron.d is not an at job because at jobs are not stored in that directory, and their content would include a date/time specification, not the standard cron time columns. Forensic investigators would find at jobs in a spool directory, not under the /etc/cron.d system-wide cron configuration.

Go deeper

Related to this question