Timestomp Hunt: Catch the Backdated Implant in the Timeline

Advanced IR. You have a filesystem timeline (/root/case/timeline.body, a Sleuth Kit body file) pulled from a compromised web host. An attacker planted an implant and TIMESTOMPED it — backdated its modified time (mtime) so it blends in with old system files. But timestomping with touch can't rewrite the inode change time (ctime): ctime records when a file's metadata was last altered, so it still holds the real drop time. For a normally-written file, ctime is greater than or equal to mtime and close to it. The implant is the opposite — an mtime years in the past but a ctime that is recent, a gap no honest file has.

The trap: a genuinely OLD system binary also has an old mtime, so a rule that flags 'old mtime' flags it too — a false positive. The real signal is the ctime-minus-mtime GAP, which is enormous only for the timestomp.

Body file fields (pipe-separated): MD5|name|inode|mode|uid|gid|size|atime|mtime|ctime|crtime — times are epoch seconds, so mtime is field 9 and ctime is field 10.

1. Identify the timestomped file and record its path in /root/case/timestomped.txt.

2. Write a detector at /root/detect.sh that reads the body file on stdin and prints the timestomped file(s) — those whose ctime is far newer than their mtime. Grading runs bash /root/detect.sh < /root/case/timeline.body, and also feeds it a second, unseen host's body file on stdin (bash /root/detect.sh < <holdout.body>) — so compute the answer from whatever arrives on stdin, not from a hardcoded path. MITRE ATT&CK: T1070.006 (Indicator Removal: Timestomp).