PICOCTF 2026 • FORENSICS • DISK & FILESYSTEM DFIR

Timeline 0: Linux Filesystem MAC Timeline Analysis

By Abdo•5 min read•PicoCTF 2026
TARGET IMAGEpartition4.img
TOOLCHAINfls, mactime, icat
ANOMALY INODE4945 (/bin/bcab)
FLAGpicoCTF{71m311...}
Linux Filesystem MAC Timeline Outlier Forensics
FIGURE 1: Forensic Workbench & Filesystem Inode TriageThe Sleuth Kit • Timestomping • Outlier
Forensic Scenario

We are tasked with investigating a raw ext4 partition image (partition4.img). In this scenario, the adversary did not leave files in the latest session; instead, they attempted to hide by backdating file timestamps to an extreme date in the past. Using The Sleuth Kit, we extract metadata into a standardized bodyfile, compile a chronological MAC timeline, identify the 1985 temporal outlier, and carve out the hidden payload directly from Inode 4945.

01. Generating the Filesystem Bodyfile with fls

Without mounting the filesystem, fls recursively traverses directory trees and parses inode metadata structures directly into the Sleuth Kit bodyfile format:

POWERSHELL • DUMP BODYFILE
fls -m / -r ./partition4.img | Out-File -Encoding ascii body.txt
Forensic Field Note: In Windows PowerShell 5.1, the default redirection operator (> body.txt) writes UTF-16 LE with byte-order marks. Perl scripts like mactime expect standard ASCII/UTF-8. Always pipe through Out-File -Encoding ascii to prevent null-byte corruption!

02. Compiling the Chronological Timeline with mactime

Next, we run mactime to translate Unix Epoch timestamps into human-readable chronological sequences:

POWERSHELL • GENERATE CSV TIMELINE
mactime -b body.txt -d -z UTC | Out-File -Encoding ascii timeline.csv

03. Detecting the Timestomped 1985 Outlier

Inspecting the earliest chronological events in the timeline reveals an immediate red flag:

POWERSHELL • INSPECT EARLIEST ENTRIES
Get-Content timeline.csv | Select-Object -First 5
// Earliest Timeline Records:
Xxx Xxx 00 0000 00:00:00, 0, macb, V/V---------, 0, 0, 119417, "/$OrphanFiles"
Tue Jan 01 1985 17:00:00, 41, macb, r/rrw-r--r--, 0, 0, 4945, "/bin/bcab"
Mon Oct 18 2021 17:54:17, 451, ma.., r/rrw-r--r--, 0, 0, 64994, "/usr/share/apk/keys/..."

The target image runs a modern 2021–2025 Alpine Linux distribution. A file stamped to Tuesday, January 1, 1985 is an undeniable temporal outlier. Furthermore, all four MACB timestamp flags (Modified, Accessed, Changed, Born) share the exact artificial second, proving deliberate timestomping on /bin/bcab (Inode 4945).

04. Inode Carving & Base64 Decoding

Using icat, we carve the raw data blocks mapped to Inode 4945 directly:

TERMINAL • CARVE INODE WITH ICAT
icat.exe ./partition4.img 4945
// Output: NzFtMzExbjNfMHU3MTEzcl9oM3JfNDNhMmU3YWYK
POWERSHELL • BASE64 DECODE
[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("NzFtMzExbjNfMHU3MTEzcl9oM3JfNDNhMmU3YWYK"))
// Decoded Plaintext: 71m311n3_0u7113r_h3r_43a2e7af(L33tspeak: "timeline_outlier_her_43a2e7af")
OFFICIAL CAPTURED FLAGpicoCTF{71m311n3_0u7113r_h3r_43a2e7af}