Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Anti-Forensics - Evidence Elimination
Mission
After intrusion the attacker tried to cover their tracks, truncating part of `/challenge/auth_syslog.log` and clearing shell history -- but traces remain. Find the unnatural time gap in the primary log, then match it against the recovered systemd journal in `/challenge/journal_recovered.txt`; the single entry that falls inside that window records the erased activity and holds the flag. This is a read-only analysis showing that anti-forensics leaves traces in secondary sources.
Hints
Hint 1 Show
auth_syslog.log carries the trace of a truncated window (a gap); read its start/end times
Hint 2 Show
shell_history.txt still holds the cleanup commands (sed deleting the window, history -c, ...)
Hint 3 Show
Find the recovered journal entry whose timestamp falls inside the gap; it holds the erased action and the flag