I am performing Forensic analysis on Host based evidence - examining partitions of a hard drive of a server.

I am interested in finding the processes all the "users" ran before the system died/rebooted.

As this isn't live analysis I can't use ps or top to see the running processes.

So, I was wondering if there is a log like /var/log/messages that shows me what processes users ran.

I have gone through a lot of logs in /var/log/\* - they give me information about logins, package updates, authorization - but nothing about the processes.