private forensys

[after_go]

Hi all.
 I would like to know from the analysis of which directories\files\processes one can draw an unambiguous conclusion: there was a user here. Maybe it’s better to use the commands

Код: [Выделить]

-ctime, -atime, -mtime, and which directories /subdirectories, processes to look at? Maybe there is a manual on this topic? I would appreciate any answers.
Тема закрыта!
 --F12

1.1. На форуме допускается публикация сообщений только на русском языке.