Falaj 15: Newer Than You

Every file records when it was last modified, and that timestamp is evidence. Which files changed after a known moment is a standard question in incident work: what was touched after the alarm, after the login, after the backup?

A marker file in your home directory was created at the start of the shift. One of the files in the entries directory is newer than the marker, and it holds the password for the next level. Use ls -l to read the timestamps and find with its comparison against another file to list everything modified after the marker. The other entries are all older.

Timestamps can be altered, so on a real system they are a lead and never a proof. Here they are what the level gives you. This is a simulated shell over invented files: it understands a teaching subset of commands, and help lists them. When you have the password for level 16, run login 16 <password> or paste it into the answer box.