wtmp / utmp / btmp
Binary login databases under /var/log and /var/run. wtmp logs successful logins, utmp reflects current sessions, btmp logs failed login attempts. Read with last, w, lastb.
Binary login databases under /var/log and /var/run. wtmp logs successful logins, utmp reflects current sessions, btmp logs failed login attempts. Read with last, w, lastb.
Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.