modDetective is a small Python tool that chronologizes files based on modification time in order to investigate recent system activity. This can be used in CTF’s in order to pinpoint where escalation and attack vectors may exist. To see the tool in its most useful form, try running the command as follows: python3 modDetective.py -i /usr/share,/usr/lib,/lib. …