Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site,
How do I identify the time and order of each user's activities on the hard disks?
The Gmail communications are easy to pick on, but I am not getting anywhere with the rest. I can see that users logged on multiple times. I can also see some failed logins, which makes me wonder what could have caused them on the first disk? The second disk installs
ssh and it looks like it runs
hydra, which is a brute-force password cracking tool. I don't see how it will be useful for them for a physical crime? The second disk also shows sessions opening, then other sessions opening before the opened ones close, which makes me wonder whether this is a remote machine. I don't really know what is going on here, so I can't figure out the timeline....