~/giac-glir · giac-glir_d1_0b489cdc1166 ▊
During a Linux intrusion investigation, an analyst suspects a malicious binary's timestamps were altered. According to the SANS whitepaper on timestomping across FAT, Ext3, and Ext4, what determines the specific methods an adversary can use to timestomp files?
Unlock this exam to join the per-question discussion and vote on questions.