The /var/log/daily.out file contains data that helps forensic investigators. Which of the following describes its contents?

• A. Data on all mounted volumes and dates they were mounted, plus data on removable media including serial numbers
• B. Browser history and cookies
• C. Only system update histories
• D. User account password hashes

Answer: (A)

The data in this log file is focused on the system’s storage state and hardware changes. Daily maintenance or diagnostic scripts often record what volumes are mounted and when, including removable media. This means you’ll typically see entries listing all mounted volumes, their mount points, and the dates they were mounted, plus attributes that can identify removable drives, such as serial numbers. For investigators, this kind of artifact helps establish what storage devices were connected to the machine and at what times, which can be crucial for timeline reconstruction and linking events across devices. Browser history, cookies, system update histories, and password hashes are stored in other locations or logs specific to those subsystems (browsers, apt history, /etc/shadow), so they don’t describe the contents of the daily.out file.