utmp, wtmp and btmp
The three binary login databases. Current sessions, the historical record, and the failed attempts, in three files that are trivially editable by anyone with root.
where it lives
/var/run/utmpWho is logged in right now. Rewritten constantly.
/var/log/wtmpThe historical record, read with last.
/var/log/btmpFailed attempts, read with lastb. Root only.
what it proves
- Session start and end, the account, the terminal, and the remote host where applicable
- Failed authentication attempts in btmp, which is where a brute force is visible as a shape
- Boot times, which anchor everything else on the timeline
what it does not prove
- Anything that did not create a session. An SSH command executed without a login shell may leave nothing here
- Integrity. These are fixed-size binary records that can be edited in place, and tooling to do it is widely available
- The real source address behind a jump host or a NAT boundary
parsing it
lastlastbutmpdumppython-utmp
tampering and anti-forensics
Editing these is a well-established and easy step. utmpdump round-trips the format to text and back, so a selective removal leaves a structurally valid file. Corroborate against auth logs and the journal rather than trusting them alone.
how long it survives
wtmp rotates on the distribution schedule, commonly monthly.