I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates.

We're supposed to answer:

* what order did people hack in and give themselves accounts?
* did a certain user mess up ssh functionality for everyone?
* what other shenanigans have people been up to?
* tips: check out /var/log/ and the programs extcarve and Bulk Extractor

And we're not taught how to do any of this :(

My thoughts / questions:

* I'm looking at the /etc/shadow file now for user accounts. This should work right? I'm not missing anything if I do it this way?
* Googling yielded the existence of a /etc/ssh/ssh\_config file, but I have no idea what to look for in here... Any tips? Is it possible to tell who modified a file? Or do I need to go through every user's /.bash\_history to check? x\_x
* I looked at the /var/logs directory and didn't see anything immediately useful. Any ideas what he may want us to look for in here?
* I'm not sure what other shenanigans he wants us to look for. extcarve and Bulk extractor sound useful if you're trying to put together statistic on the entire drive, or maybe a file was deleted and you want to check on what's left of it? Do you think that's what he has in mind?

Sorry for the noob questions, but thanks for any help!