Beginner forensics challenges: the filename is not the clock

The filename is a label

morning.pcap, disk-2024.img, or photo-final.png is the name on the challenge bundle. It helps you find the file. It is not a timestamp the tool measured, and it is not the flag. A word like morning can be wrong, vague, or only a joke in the title.

The extension is part of that label. Identifying the format is a separate check. This note is about the clock, not about renaming the file.

The inner clock is in the content

A packet capture can carry a timestamp on a frame. A photo can carry a metadata time. A log inside an archive can carry its own line times. Those are the clocks you quote when you say when something in the file happened. If the field is missing, write “no time field in the part I opened.”

Do not edit the inner time so it matches the filename. The disagreement is the note.

What to write down

File the filename, the inner time with the field name, and where in the file you read it. If you mention “when,” say which of those you mean. A filename with no digits is not a date.

Lab: a morning file and an afternoon frame

The practice bundle names the capture morning.pcap. The first frame you open has a timestamp of 2026-04-02T15:04:11Z. A draft says the traffic was in the morning because of the filename.

The note lists morning.pcap as the label and 15:04:11Z as the frame time. The sentence about when the frame was recorded uses the frame. The filename is not rewritten and is not used as the clock.

filename: morning.pcap
frame timestamp: 2026-04-02T15:04:11Z
field: the frame you opened
write: label and frame time
not: the traffic was in the morning