Difference between revisions of "Type UTMP"
Jump to navigation
Jump to search
| Line 30: | Line 30: | ||
=Description= | =Description= | ||
Records various unix system status items. | Records various unix system status items. | ||
| − | |||
| − | |||
| − | |||
=Truxton Exploiters= | =Truxton Exploiters= | ||
| Line 43: | Line 40: | ||
* <code>LastWrite</code> - When the file was last modified | * <code>LastWrite</code> - When the file was last modified | ||
* <code>Name</code> - The name of the file | * <code>Name</code> - The name of the file | ||
| + | |||
| + | =Details= | ||
| + | * [https://en.wikipedia.org/wiki/Utmp Wikipedia] | ||
Revision as of 16:26, 15 January 2024
| Defined Constant | Type_UTMP
|
| File Type Value | 997 |
| Parent Type | None |
| Carve | Yes |
| Format Details | No |
| Carve Meta Data | Yes |
| MIME Type | application/octet-stream
|
| Filename Extension | utmp
|
UTMP
Description
Records various unix system status items.
Truxton Exploiters
This file type is handled by the following ETLs:
Carve Meta Data
When Truxton carves this file, it can populate the following columns in the [File] table:
Created- When the file was createdLastWrite- When the file was last modifiedName- The name of the file
