Let us suppose that a hacker was able to gain root access to a UNIX system. He copied certain files and then changed the system log file to remove information about his access to the system. How could time-stamps analysis help detecting this access
time-stamps analysis
security;timestamps