writeups2026tamu/Time-Capsule-forensics.md

Time Capsule - forensics

fridgebuyer

• mount the image
• in nostalgia/ ASCII chars can be derived from each file's mtime
• char = minutes * 60 + seconds

memory_1.jpg 2007-01-01 02:01:43

-- 1*60+43 = 103 = 'g'

python3 << 'EOF'
import os, datetime

flag = ""
for i in range(1, 18):
    f = next(f for f in os.listdir(".") if f.startswith(f"memory_{i}."))
    dt = datetime.datetime.fromtimestamp(os.stat(f).st_mtime)
    ascii_val = dt.minute * 60 + dt.second
    char = chr(ascii_val)
    flag += char
    print(f"{f:<20} {dt.strftime('%H:%M:%S')}  min={dt.minute} sec={dt.second}  -> {ascii_val} -> '{char}'")

print(f"\nFlag: {flag}")
EOF

gigem{byg0n3_3r4}