Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1
and disk2
.
How do I identify the time and order of each user's activities on the hard disks?
The Gmail communications are easy to pick on, but I am not getting anywhere with the rest. I can see that users logged on multiple times. I can also see some failed logins, which makes me wonder what could have caused them on the first disk? The second disk installs ssh
and it looks like it runs hydra
, which is a brute-force password cracking tool. I don't see how it will be useful for them for a physical crime? The second disk also shows sessions opening, then other sessions opening before the opened ones close, which makes me wonder whether this is a remote machine. I don't really know what is going on here, so I can't figure out the timeline....
disk1
(larger)
disk2
(larger)