PICOCTF 2026 • FORENSICS • DISK & FILESYSTEM DFIR

Timeline: Linux Filesystem MAC Timeline Analysis

By Abdo•5 min read•PicoCTF 2026
TARGET IMAGEpartition4.img
TOOLCHAINfls, mactime, icat
ANOMALY INODE32716 (/etc/chat)
FLAGpicoCTF{573417...}
Linux Filesystem MAC Timeline Forensics
FIGURE 1: Digital Forensics Laboratory & Filesystem Inode TriageThe Sleuth Kit • Bodyfile • mactime
Forensic Scenario

We are tasked with investigating a raw ext4 partition image (partition4.img) to determine what happened on the operating system before it was powered down. Using The Sleuth Kit, we extract metadata into a standardized bodyfile, compile a chronological MAC timeline, trace the pre-shutdown event horizon, and carve out the hidden flag artifact.

01. Generating the Filesystem Bodyfile with fls

Without mounting the filesystem, fls recursively traverses directory trees and parses inode metadata structures directly into the Sleuth Kit bodyfile format:

POWERSHELL • DUMP BODYFILE
fls -m / -r ./partition4.img | Out-File -Encoding ascii body.txt
Forensic Field Note: In Windows PowerShell 5.1, the default redirection operator (> body.txt) writes UTF-16 LE with byte-order marks. Perl scripts like mactime expect standard ASCII/UTF-8. Always pipe through Out-File -Encoding ascii to prevent null-byte corruption!

02. Compiling the Chronological Timeline with mactime

Next, we run mactime to translate Unix Epoch timestamps into human-readable chronological sequences:

POWERSHELL • GENERATE CSV TIMELINE
mactime -b body.txt -d -z UTC > timeline.csv

03. The Pre-Shutdown Event Horizon

Filtering for activity on December 1, 2025 reveals the system's final active moments:

POWERSHELL • FILTER FINAL SESSION
mactime -b body.txt -d -z UTC 2025-12-01 | Select-Object -Last 30
// Chronological Observations:
Mon Dec 01 2025 21:50:23 UTC — /root/.ash_history (poweroff executed)
Mon Dec 01 2025 21:50:07 UTC — /etc/chat (Inode 32716, 49 bytes, macb)

Exactly 16 seconds before the administrator typed poweroff, a brand-new file named /etc/chat was created with flag macb (Modified, Accessed, Changed, Born).

04. Inode Carving & Base64 Decoding

Using icat, we stream the raw data blocks mapped to Inode 32716 directly without mounting the partition:

TERMINAL • CARVE INODE WITH ICAT
icat.exe ./partition4.img 32716
// Output: NTczNDE3aDEzcl83aDRuXzdoM18xNDU3XzU4NTI3YmIyMjIK
POWERSHELL • BASE64 DECODE
[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("NTczNDE3aDEzcl83aDRuXzdoM18xNDU3XzU4NTI3YmIyMjIK"))
// Decoded Plaintext: 573417h13r_7h4n_7h3_1457_58527bb222(L33tspeak: "stealthier_than_the_last_58527bb222")
OFFICIAL CAPTURED FLAGpicoCTF{573417h13r_7h4n_7h3_1457_58527bb222}