Category: DFIR
Difficulty: hard
Author: 2keebs
- What time was
passwd.txtfirst opened by the user Challenger? - What string was contained in
passwd.txt?
Flag format: DUCTF{hh:mm:ss_string} e.g. DUCTF{18:13:45_hunter2}
Note: This challenge uses the same file from "DFIR Investigation 1"