logs

/var/log/auth.log
/var/log/syslog
/var/log/messages
/var/log/daemon.log
/var/log/boot.log
/var/log/kern.log

utmpdump /var/run/utmp > utmp.log 
utmpdump /var/log/wtmp > wtmp.log
utmpdump /var/log/btmp > btmp.log

utmpdump /var/run/utmp | grep "\[0\].*1970-01-01" 
utmpdump /var/log/wtmp | grep "\[0\].*1970-01-01" 
utmpdump /var/log/btmp | grep "\[0\].*1970-01-01"

/var/log/cron.log
/var/log/dpkg.log

/home/user/.bash_profile
/home/user/.bash_history
/home/user/.zshrc

~/.ssh/authorized_keys

/tmp
/var/tmp

Using Linux utmpdump for Forensics and Detecting Log File TamperingSandfly Security - Agentless Linux EDR and Incident Response