> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2024/forensics/blast-from-the-past-medium.md).

# Blast from the past (Medium)

<figure><img src="/files/9KDFZKTvLv8LYjsrc3XF" alt=""><figcaption></figcaption></figure>

wget <https://artifacts.picoctf.net/c_mimas/90/original.jpg>

***

If we check the file with exiftools:&#x20;

<figure><img src="/files/ge4mDc7CsDdzbS9PBd3r" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/3jFl0KiHxhl3QA2xcTNr" alt=""><figcaption></figcaption></figure>

We get a fair amount of information. The first thing to do is to obviously change these timestamps. exiftool actually has a specific command just for this.&#x20;

```
exiftool -AllDates='1970:01:01 00:00:00.001' original_modified.jpg
```

This then solves most of it, except we stumble at the SubSecCreateDate tag. Here, we need to to manually specify it.

```
exiftool -SubSecCreateDate='1970:01:01 00:00:00.001' -SubSecDateTimeOriginal='1970:01:01 00:00:00.001' -SubSecModifyDate='1970:01:01 00:00:00.001' original_modified.jpg
```

Lastly, we have the last one. However since exiftool cannot change the samsung timestamp, we need to use another tool.&#x20;

<figure><img src="/files/LOQom3J1sw5OFZh4eOdB" alt=""><figcaption></figcaption></figure>

To solve this one, we need to manually edit the file. However, to first find the time stamp, I just did a simple strings along side grep. When we're at the location, we can just change it.

Specfically, near the timestamp we can replace 1700513181420 with 0000000000001 (13 digits representing 1 millisecond).