wtmp timeline efforts
In DFIR activities timelines are often determinant to understand what happened (lot of refs here ). Luckily Kristinn Gudjonsson provided the community with the great log2timeline tool ( here , from now l2t ) that, along with the invaluable Brian Carrier 's SleuthKit , gives a (temporal) order to chaos . But l2t is not currently considering valuable artifacts coming from wtmp / btmp files on Linux systems. wtmp (utmp? btmp!) For a rapid introduction to those files let's see what wikipedia says about them: " utmp, wtmp, btmp and variants such as utmpx, wtmpx and btmpx are files on Unix-like systems that keeps track of all logins and logouts to the system . The utmp file keeps track of the current login state of each user . The wtmp file records all logins and logouts history . The btmp file records failed login attempts . The utmp, wtmp and btmp files were never a part of any official Unix standard, such as Single UNIX Specificat