Anti-Forensics Hunt: Timestomping & Log Scrubbing

A capable intruder cleans up after themselves — and each technique leaves a tell. Two here:

Timestomping — a planted web shell in /root/case/evidence had its mtime backdated to blend in with old files, but touch can't fake the inode change time (ctime), so the shell's ctime is recent while its mtime claims to be years old. Find that file (ctime ≫ mtime) and record its full absolute path (starting /root/case/evidence/, on a line by itself) to /root/case/answers/timestomped.txt.

Log scrubbing — the attacker deleted their successful SSH login from /root/case/logs/auth.log, but the session still shows in the wtmp/last record (/root/case/logs/wtmp.txt). Cross-reference the two: the source IP with a session in wtmp but no Accepted line in auth.log is the scrubbed login (don't fall for the loud brute-forcer that only ever failed). Record that IP to /root/case/answers/scrubbed_ip.txt. See /root/case/brief.txt.