A friend of mine noted an interesting article discussing someone’s Linux system, which was behaving strangely. It turned out that it had been hacked, and the article shows the basic forensics investigation to see what really happened.

Have a look at Holliday cracking. Thanks Göran.