MFT Timeline Reconstruction
forensics · hard · +55 XP
Target
GET /api/lab/mft-timeline-101/entries (10 $MFT entries with file+timestamps)
POST /api/lab/mft-timeline-101/submit body {filename, created_at_iso}
Goal: filter *.exe files in %TEMP%. Find the earliest created_at. Submit (filename, iso timestamp) for flag.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/mft-timeline-101/
// reuse on the cli
// submit flag
// no solves yet
4 of 13 · forensics