Posts tagged: #wtmp

How to prove Linux logs were edited or deleted: journal seqnum gaps, lines missing from auth.log, blanked wtmp records, stopped daemons and clearing commands.

How the four Linux log families fit together in an investigation, what each one proves, where they disagree, and how to merge them into one timeline.

Linux login records in an investigation: struct utmp on x86_64 and aarch64, btmp failed logins, lastlog slots, wtmpdb and lastlog2 SQLite files, tampering.