Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness?

In a cyber-forensic investigation, a CHFI expert found a Linux system unexpectedly booting into a different OS kernel. The system was configured with the Grand Unified Bootloader (GRUB). The expert suspects that an attacker may have tampered with the bootloader stage of the Linux boot process. Which one of the following is NOT a step performed during the bootloader stage in a normal Linux boot process?

Someone in the field of forensic investigation is looking at an Apache access log. They're searching for any evidence of a command injection attack. During this process, they find a log entry where the IP address "10.0.0.8" placed a GET request using the command ip=127.0.0.1;ls+/var/www/html. Judging by this data, what might be the individual's objective behind this attack?

In an ongoing cybercrime investigation, Laura, a certified Computer Hacking Forensics Investigator (CHFI), has identified a system involved in illegal activities. The system is connected to a network with many other users. Laura needs to gather evidence related to the identified system's internet usage. Which legal and privacy considerations should be her utmost priority?

In the event of a fileless malware attack, a Computer Hacking Forensics Investigator (CHFI) notes that the fileless malware has managed to persist even after the system reboots. What built- in Windows tool/utility might the attacker most likely have leveraged for this persistent behavior?