Forensics 15. Elementary diagnostics using 'strings'

strings tells you what ASCII text exists inside a file:

  bash# strings login.FCS|more
  /var/spool/lp/.lpr
  [file]
  [spool]
  lpr2

(etc)

  bash# cat /var/spool/lp/.lpr
  [spool]
  lpr2=sexygurl

In this case a Trojan version of /bin/login had been provided which allowed anyone to login as any user with the password sexygurl.