Connecting the dots
echo "export PS1='$ '" >> ~/.bash_profile
In this article, I am going to talk about basic forensic time analysis procedure:
Antedating: Creating a document with incorrect time stamps.
How to antedate a document?
Let me try to list down some of the things that a Incident response team will lose volatile data if they turn off the suspect's machine.
1) Logged in Users
2) TCP Connections
3) Running Processes