@MissMuppetz Create a timeline with log2timeline. Search for deleted history w/ string search for common cmds like "cd /" or "ssh ".