Posts tagged: #dfir

How the four Linux log families fit together in an investigation, what each one proves, where they disagree, and how to merge them into one timeline.