> For the complete documentation index, see [llms.txt](https://notes.m4lwhere.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.m4lwhere.org/defensive/linux-forensics.md).

# Linux Forensics

Accounting entries:

* utmp
  * Info about currently logged in users
* wtmp
  * Data about past user logins
* btmp
  * Bad login entries for failed login attempts
* lastlog
  * Shows login name, port, and last login time for each user