Important Day was a 100 points challenge where you were provided with a pcap file, and asked to determine when the system was powered on.
By looking at the pcap file it really looked like a portscan, and by a quick google search i ran into a post from back in 2006 on seclists.org discussing about the possibility to guess the time of the last system reboot, by looking at the TCP protocol TSVAL option.
Bsically since the TSVAL counter is reset to zero every time the system reboots (at least on many OSes), if you know the frequency at which TSVAL is increased, you can try to guess the boot timestamp.
As the challenge was providing a pcap, we had the capture timestamp, so if we had enaugh TSVAL options to compare, we could try to guess the system uptime.
The tickrate at which TSVAL increases is different from Operating System to Operating System, and with only the pcap i didn’t know the target OS, but i had multiple packets to analyze, so it was probably a matter of math.
And then analyzed how the TSVAL increased compared to the milliseconds in the packet capture timestamp.
And that’s the good point, and the fact that really disappointed me, as i spent a lot of time with trial and error thinking i was doing things wrong, when at a certain point, with all the frustration i had accumulated, i went on the CTF IRC channel asking an admin if something was broken, and then he pointed out that i was supposed to provide the date in IRST timezone.
I mean, WHAT? are you kidding me? timestamps in forensics not in UTC? come on, please, guess what would happen if you were to ask logs to an ISP for a specific IP address at a certain timestamp not in UTC.. you might send an innocent on trial because of that.