Tcp.log is the where linsniffer would log the sniffed information. Logclear is simply a script to kill -9 linsniff, erase the tcp.log, touch a new tcp.log and restart linsniff in the background. Mkxfs is what appears to be a hacked version of sshd. S is the sshd configuration file for the hacked version of sshd. This config file already has the host keys being pulled from the hackers location.
Sense is a linsniff log sorting utility script to format the output of linsniff.
Luckily the manual way provided lots of information very quickly. I did not expect such results. TCT will gather information for me that it would be easy to miss while doing things manually. I'll start with unrm to gather any deleted information from the hard drive. I went into the blocks directory and did various greps of the information searching for words I'd seen earlier in the recovery.