In a Linux-based system, what does the command "Last -F" display?

The correct answer is A. Login and logout times and dates of the system. The 'last' command reads the /var/log/wtmp binary log file to display a history of user logins, logouts, and system reboots. The '-F' flag forces full date and time output - including the year - rather than the default abbreviated format that omits the year. Forensic…

Submitted by thandi_sa· Apr 18, 2026Disk Forensics

Question

Options

ALogin and logout times and dates of the system
BLast run processes
CLast functions performed
DRecently opened files

How the community answered

(29 responses)

A
90% (26)
B
3% (1)
C
3% (1)
D
3% (1)

Explanation

The 'last' command reads the /var/log/wtmp binary log file to display a history of user logins, logouts, and system reboots. The '-F' flag forces full date and time output - including the year - rather than the default abbreviated format that omits the year. Forensic investigators use 'last -F' to reconstruct a precise timeline of who logged into the system, when they logged in, and when they logged out, which is critical for establishing a chronology of events during an investigation.

Topics

#Linux command#System logs#User activity#Forensic tools

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice