Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Detect Tampered Timestamps
Mission
Analyze the NTFS-like timeline in `mft_timeline.csv` and compare each file's SI and FN timestamps. The physically impossible record whose FN creation time is later than its SI modification time is evidence of timestomping; its note column contains the flag.
Hints
Hint 1 Show
Each file in mft_timeline.csv carries two timestamp sets: $STANDARD_INFORMATION (SI) and $FILE_NAME (FN)
Hint 2 Show
A timestomp tool rewrites SI but struggles to change FN (held in the parent directory index)
Hint 3 Show
Exactly one row is physically impossible -- its FN birth time is newer than its SI modified time -- and it holds the flag