Timeline Tangle

Challenge Question

A ransomware incident left behind disk metadata, event logs and prefetch files, and each source only tells part of the story. Rebuild the exact sequence of events by correlating the evidence, then prove it with the one timestamp that ties everything together.