Metadata Inventory: The File That Lies

You're triaging the contents of /evidence/disk recovered from a workstation. Build a defensible inventory — names, sizes, and hashes — but the real goal is the anomaly hunt: one of these files is not what its name claims. An attacker likes to hide an executable behind an innocent extension so it slips past a glance at the directory listing. The directory entry and the extension are just labels; the file's magic bytes are the truth — and a matching extension is no proof either, so check every file. Find the disguised file.

Produce two files: /root/case/inventory.txt (every evidence file's name with its SHA-256 — sha256sum's own <digest> <path> lines are fine; grading checks each file's hash against the pristine evidence) and /root/case/suspect.txt (just the disguised file's name, one line — the bare name, its full path, or file's own line for it are accepted; a list of several files is not).