2.1 Audit Logs

Fatback uses audit logs to keep a record of operations performed in a session. The data it logs includes the commands the user types, the command line used to execute the program, the users environment, information about the partition being analyzed, and information about each file that was recovered.

By default, the audit log will be written to a file called fatback.log in the current directory. To store the audit log to a different location, use the -l file or --log=file switch.