utmpdump wtmp

utmpdump /var/log/wtmp

Dumps the binary content of wtmp/btmp to readable text, revealing entries that standard tools hide or misinterpret.

Run it in forensics when last doesn't tell the whole story: wtmp is a binary file with a fixed structure and utmpdump dumps it field by field, including corrupt, truncated, or manipulated entries that last silently ignores. It's the IR tool when you suspect the attacker touched session logs: entries with impossible timestamps, weird uids, or empty fields in the middle of the file are the signature of manipulation. It's also the way to extract raw detail (pid, entry type, origin) for the forensic report without relying on last's parsing.

Don't use it for quick logon analysis: the raw output is noisy and last does the readable job. And watch out for the format: utmpdump entries vary between architectures and libc versions (the utmp struct isn't identical everywhere), so interpreting fields requires knowing the version of the system that generated the file. On heavily manipulated files, utmpdump may fail or show garbage — that itself is evidence of manipulation, but it doesn't give you the original data. For a clean timeline, combine with wtmp from backups or the SIEM.