You are informed that an unprivileged user has executed commands as the superuser. You decide to look at the log file for the su(1) command. The contents in the log file are:

SU 12/07 11:50 + pts/6 gv1123-root
SU 12/07 11:54 – pts/5 fb12-root
SU 12/07 11:54 + pts/3 gv1123-root

SU 12/07 12:03 + pts/1 jjj-gv1123

You know the file has NOT been tampered with. Which two statements are true? (Choose two.)

A.
User jjj is not a suspect.

B.
The commands might have been executed on pts/1.

C.
The commands might have been executed on pts/3.

D.
User fb12 is suspected of having executed the commands.

E.
User gv1123 is suspected of having executed the commands.