Home / Labs / Threat Hunter: Timeline Reconstruction

Threat Hunter: Timeline Reconstruction

Use file timestamps to reconstruct the attacker's actions in chronological order.

Open this lab

Commands practised here

• ls -la <dir>Shows files with timestamps.
• stat <file>Shows detailed timestamps (mtime, ctime, atime).
• ls -la <dir> | sort -k6,7Sorts files chronologically.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Rebuild the Timeline
• Map the User Sessions