Just want more clear on knowledgebase regarding tripwire .
Tripwire report can tell a file being modified with comparing with baseline generated by tripwire .
Also the report show who was the one last modified the file , I want to know “who” information that come from where and how ?
As Unix SA I can not recall any way UNIX system had this information restored in any file or inode .
Thank you .