It's for an assignment to practice a bit of forensics. We're given VirtualBox images and told to figure out if a certain user messed up the ssh config.
I mounted the image as read-only, and found that the user's .bash_history reads:
rm .bash_history exit
I'm pretty stuck. Does anyone have any advice?
I'm currently trying (unsuccessfully) to figure out the extcarve tool, and what its output files are.