Questions in This Category
Q074To which date was the implant timestamp forged (timestomp)?
Q075Attacker's real activity date (from logs)?
Q076Which command forged the timestamp?
Q146To which file was timestomp applied?
Q147Year gap between the forged and real dates?
Q179Which log file did the attacker destroy?