Uses Sleuth Kit from SANS SIFT Workstation (you can download separately and not use a VM) to create a timeline and then view the contents of the file that is suspiciously old.
Pico2026 Timeline 0
Pico2026 Timeline 0
Pico2026 Timeline 1
Picoctf Timeline 0
Pico2026 Shift Registers
Pico2026 Bytemancy0