I've just taken a job tracing down a hacker (this is my second time doing a trace job, so I know what I'm doing somewhat). The weird thing is, the company that employed me didn't give me access into their hacked system, so I had to hack in myself. The hack on their system supposedly occurred at 16:00, 8-4-2010. But when I got to their logs, I only found three logs on 8-4-2010, and they were all around 03:00 -- nowhere near 16:00. So, I don't really know what to do. I ran the log undeleter on all of them, but they all stayed unchanged. Ideas?
------------------