code: def _ParseWtmp():
    
    users = {}
  
    wtmp_struct_size = UtmpStruct.GetSize()
    filenames = glob.glob("/var/log/wtmp*") + ["/var/run/utmp"]
  
    for filename in filenames:
      try:
        wtmp = open(filename, "rb").read()
      except IOError:
        continue
  
      for offset in range(0, len(wtmp), wtmp_struct_size):
        try:
          record = UtmpStruct(wtmp[offset:offset + wtmp_struct_size])
        except utils.ParsingError:
          break
  
        # Users only appear for USER_PROCESS events, others are system.
        if record.ut_type != 7:
          continue
  
        try:
          if users[record.ut_user] < record.tv_sec:
            users[record.ut_user] = record.tv_sec
        except KeyError:
          users[record.ut_user] = record.tv_sec
  
    return users
docs: Parse wtmp and utmp and extract the last logon time.