Forensics
Difficulty: medium
Log Format: syslog
The Missing Hour
The auth log has a 47-minute hole in it. Logs don't develop holes on their own. Someone deleted the evidence — but they left fingerprints doing it.
Log TamperingForensicsAnti-Forensics
Investigation Scenario
The auth log has a 47-minute hole in it. Logs don't develop holes on their own. Someone deleted the evidence — but they left fingerprints doing it.