Notes post-mortem

sudo mactime -d /mnt -R -g /mnt/etc/group -p 
 /mnt/etc/passwd 1/2/1970 > timeline.txt