Carving utmp records for intrusion analysis