• carcus@lemmy.ml
      link
      fedilink
      English
      arrow-up
      4
      ·
      11 months ago

      I’ve had to do forensics on a rogue change. In finding when and who actually changed the file, mtime can help narrow it down when compared with wtmp.