Skip to main content

LINUX_LASTLOG

forensic_catalog::artifact

Static LINUX_LASTLOG 

Source 
pub static LINUX_LASTLOG: ArtifactDescriptor
Expand description

/var/log/lastlog — binary last-login-per-UID database.

Fixed-offset binary file indexed by UID. lastlog command reads it. Each entry records last login time and source IP.