I have a server that is down due to, I believe, some nefarious activity. It no longer boots. Something is corrupted. I have several WTMP files that I would like to review. I have the hard drive, but not the server itself. I have come to find out that depending on the time of the server you read the WTPM file on the time zone changes. How do I determine the the original time the login/logout occured?
I do not know if the original server the WTMP's came from was set to UTC, EST, DST, PST, etc. Is there anyway to look at the WTMP and determine the correct time/time zone? Thanks in advance.
I do not know if the original server the WTMP's came from was set to UTC, EST, DST, PST, etc. Is there anyway to look at the WTMP and determine the correct time/time zone? Thanks in advance.