added writeups exported from ctfnote

Time-Capsule-forensics.md

@@ -0,0 +1,33 @@
+# Time Capsule - forensics
+fridgebuyer
+
+- mount the image
+- in nostalgia/ ASCII chars can be derived from each file's mtime 
+- char = minutes * 60 + seconds
+
+memory_1.jpg         2007-01-01 02:01:43  
+
+--  1*60+43 = 103 = 'g'
+
+```
+
+python3 << 'EOF'
+import os, datetime
+
+flag = ""
+for i in range(1, 18):
+    f = next(f for f in os.listdir(".") if f.startswith(f"memory_{i}."))
+    dt = datetime.datetime.fromtimestamp(os.stat(f).st_mtime)
+    ascii_val = dt.minute * 60 + dt.second
+    char = chr(ascii_val)
+    flag += char
+    print(f"{f:<20} {dt.strftime('%H:%M:%S')}  min={dt.minute} sec={dt.second}  -> {ascii_val} -> '{char}'")
+
+print(f"\nFlag: {flag}")
+EOF
+
+```
+
+**gigem{byg0n3_3r4}**
+
+