Forensics 14. Elementary diagnostics using 'file'

file can usually tell you which program caused a core dump:

  bash# ls -ltra /
  [...]
  -rw-r--r--  1 root root 895604 May  1 04:33 core
  -r-x------  1 root root 180816 May  1 04:38 mp
  drwxrwxr-x 26 root  sys   3072 May  1 06:02 etc
  drwxrwxrwt  4 sys   sys   3584 May  2 10:00 tmp
  dr-xr-xr-x  2 root root  64192 May  2 10:02 proc

  bash# file core
  core:           ELF 32-bit MSB core file
   SPARC Version 1, from 'rpc.ttdbserver'