Linux硬盘文件分析取证(SSH过的IP)

1.如题：文件中找到ssh过的IP

2.下载文件，使用AccessDataFTKImager挂载
3.通过资料得知linux系统日志存放地址是在/root/var/log/messages
4.在messages中查找，使用ctrl+f快速查找ssh，发现：
Nov  1 12:40:59 localhost auth.info sshd[3923]: Accepted password for root from 172.16.110.15 port 45466 ssh2
Nov  1 12:41:10 localhost auth.info sshd[3923]: Received disconnect from 172.16.110.15 port 45466:11: disconnected by user
Nov  1 12:41:10 localhost auth.info sshd[3923]: Disconnected from user root 172.16.110.15 port 45466
5.测试172.16.110.15
6.验证通过，得到KEY