Week 4 Reflection: What Makes a Terminal Investigation Trustworthy?

Use your command transcript and System Snapshot.

Write 150 to 250 words, or record an equivalent explanation, responding to this prompt:

A student runs several commands, sees an unfamiliar process, and immediately calls it malware. What should the student have done differently?

Include:

• one command you used this week
• one observation from its output
• one conclusion the output supports
• one conclusion it does not support
• one reason to inspect before changing system state
• one additional piece of evidence that would strengthen the investigation

Finish with:

The terminal becomes evidence instead of noise when...