carcus, 1 year ago

I’ve had to do forensics on a rogue change. In finding when and who actually changed the file, mtime can help narrow it down when compared with wtmp.