October 2021
Beginner to intermediate
400 pages
11h 15m
English

It is often necessary to reconstruct user login activity to know when a person has logged in to a system, how they logged in, what they were doing, and when they finally logged out. This chapter explains various aspects of shell and desktop user logins, and describes various artifacts that are interesting from a digital forensics perspective.
We are primarily focused on human interaction with the computer. Other system “users” are running daemons or starting programs, but they are part of normal system operation and are covered in other sections of the book. The human use of peripheral devices, ...
Read now
Unlock full access