• carcus@lemmy.ml
    link
    fedilink
    English
    arrow-up
    4
    ·
    10 months ago

    I’ve had to do forensics on a rogue change. In finding when and who actually changed the file, mtime can help narrow it down when compared with wtmp.