Forensics 4. So, what actually happened?

Signs of tampering on the SGIs:

  Aug 29 14:16:48 6C:foo telnetd[123619]:
    connect from bar
  Aug 29 14:16:49 5B:foo overly long syslog
    message detected, truncating
  Aug 29 14:16:49 0E:foo telnetd[123619]:
    ignored attempt to setenv(_RLD,^?D^
    X^\    ^?D^X^^   ^D^P^?^?$^B^Cs#^?^B^T#d~
    ^H#e~^P/d~^P/`~^T#`~^O^C^?^?L/bin/sh