Archiving History files

[genesiswave at gmail.com (genesiswave at gmail.com)]

Modify his script to move the files elsewhere
------Original Message------
From: Monkey Daemon
Sender: pauldotcom-bounces at mail.pauldotcom.com
To: PaulDotCom Security Weekly Mailing List
ReplyTo: PaulDotCom Security Weekly Mailing List
Subject: [Pauldotcom] Archiving History files
Sent: Jan 19, 2010 4:50 AM

Hi,

I've just discovered a system on which one of our darling users has
decided adding a script to his .bash_logout file that removes
.bash_history on logout is a clever thing to do.

Is there a way to take a copy of the .bash_history file before it is
deleted? This user obviously has something to hide as far as I'm
concerned, so I need to archive this file to present it as evidence.

Thanks in advance,

MWD.
_______________________________________________
Pauldotcom mailing list
Pauldotcom at mail.pauldotcom.com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com


Sent via BlackBerry from T-Mobile