Which of the following MOST likely occurred?

A security engineer is looking at a DNS server following a known incident.

The engineer sees the following command as the most recent entry in the server’s shell history:

id ^f=iev/sda of=/dev/sdb

Which of the following MOST likely occurred?
A . A tape backup of the server was performed.
B . The drive was cloned for forensic analysis.
C . The hard drive was formatted after the incident.
D . The DNS log files were rolled daily as expected

Answer: B