Anti-Forensics: Which Log Did They Wipe?

After the intrusion the attacker tried to cover their tracks. root's shell history still shows the anti-forensics command they ran — the one that truncated a log file to destroy evidence.

Read /root/.bash_history, find the command that wiped a log (a redirection that empties a file, e.g. > /var/log/... or truncate/: >), and record the FULL PATH of the log they tampered with to /root/case/tampered_log.txt: a plain-text file holding just that path on one line (the wiping command line itself is accepted too).

Grading checks the recorded path. The history has plenty of normal commands, and the attacker READ other logs too — only one command destroys a log, and only that log's path is the answer.