utmp / wtmp / btmp Login Records
| Format | utmp / wtmp / btmp Login Records |
|---|---|
| Short name | utmp |
| Category | log |
| Platforms | Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Binary login records on Linux and other Unix systems: utmp (current sessions, /run/utmp or /var/run/utmp), wtmp (login/logout, boot and shutdown history, /var/log/wtmp) and btmp (failed logins, /var/log/btmp). Each record has type, PID, terminal, user name, remote host or IP and a timestamp. Record layouts differ between operating systems and architectures (glibc: 384 bytes). No header or signature; records are recognised by size and layout. The files carry no integrity protection and can be edited or truncated. btmp may contain passwords mistakenly entered as user names. Some distributions (e.g. openSUSE since 2023) replaced utmp/wtmp/lastlog with the Y2038-safe SQLite-based wtmpdb and lastlog2.
Signatures
None recorded
Known extensions
None recorded
References
- utmp(5) — Linux manual page https://man7.org/linux/man-pages/man5/utmp.5.html
- Utmp login records format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/Utmp%20login%20records%20format.asciidoc
Cite this entry
Crush Format Reference, “utmp / wtmp / btmp Login Records”. https://kalink0.github.io/crush-forensics/formats/utmp/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction