IT Forensics · Linux

Forensic analysis of load and load log records – Evaluating login histories in a traceable manner

The files `wtmp` and `lastlog` log the login histories of individual user accounts, including the time, terminal and, in some cases, the source of the login. They form the data basis for commands such as `last` and `lastlog`.

Enquire without obligation

For forensic analysis, these files are not examined using the standard commands of the running system, but are extracted directly from the backup copy in order to rule out any tampering with the running system.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We extract wtmp and lastlog data directly from the backed-up image, reconstruct the complete login history and cross-check it against other authentication logs.

Typical areas of application

•Reconstruction of login times and origins
•Evidence of unauthorised access to user accounts
•Investigation of unusual application patterns
•Alignment with SSH and PAM protocols
•Incident Response on Linux Systems
•Judicial and non-judicial expert reports

This is how a load/load log analysis works

Once the data has been backed up, the relevant binary files are extracted directly from the forensic image and analysed in a structured manner. The login history reconstructed from this is then cross-referenced with SSH, PAM and other authentication protocols to obtain a consistent overall picture.

Why is this analysis relevant from a forensic perspective?

Login histories are often a key starting point for investigating unauthorised access or unusual usage patterns in individual user accounts.

As these files can, in principle, be tampered with, their reliability is always assessed by cross-referencing them with other independent sources, such as SSH or auditd logs, rather than being considered in isolation.

Frequently Asked Questions

What is the difference between `wtmp` and `lastlog`?+
wtmp logs a continuous history of all logins and logouts, whereas lastlog only stores the most recent login for each user.
Can these files be tampered with?+
Yes, in principle, it is possible for users with sufficient rights to tamper with the data, which is why a cross-check with other sources is carried out.
Is the ‘last’ command sufficient for a forensic analysis?+
No, to ensure the results are forensically sound, the underlying binary files are analysed directly from the backed-up image.

🔗 Related topics

LanCologne – Linux Forensics Cologne

Do you require a professional forensic investigation into „the forensic analysis of load and load log files"? LanCologne can assist you with the court-admissible preservation of digital evidence and the traceable analysis of relevant Linux artefacts.

Get in touch now