/var/log/wtmp (last)

/var/log/wtmp contains binary data indicating login times and duration for each user on the system. It is used by the 'last' command to generate a listing of user logins.