As part of a forensics investigation, you need to recover the logon and logoff history information on a Linux based OS. Where can this information be found?
A)/ var/ log/ utmp
B)/ var/ log/ wtmp
C)/ var/ log/ userlog
D)/ var/ log/ system.log

Question

As part of a forensics investigation, you need to recover the logon and logoff history information on a Linux based OS. Where can this information be found?​
A)​​/ var​/ log​/ utmp
B)​​/ var​/ log​/ wtmp
C)​/ var​/ log​/ userlog
D)​/ var​/ log​/ system.log

Quizplus · Accepted Answer

The logon and logoff history information on a Linux based OS is stored in the /var/log/wtmp file. This file contains a record of all user logins and logouts, as well as system reboots and shutdowns. The /var/log/utmp file contains similar information, but only for currently logged-in users. The /var/log/userlog and /var/log/system.log files do not contain this information.

As Part of a Forensics Investigation, You Need to Recover