For a cyber security competition I participate in, I\'m given a Debian virtual machine with many packages installed and asked to clean extraneous or malicious packages.
I dont know if it's possible to distiguich between user installation and default package installation, because the only way to install package is to have ROOT
privillages. but you cat get all package installed and their status in one file by executing this command
dpkg --get-selections > installed_packages.txt