we find a file that was created by the maker in the process of creation ie : flag.txt.
Flag.txt was created 22 august 2017
find / -type f -newermt 2017-08-20 ! -newermt 2017-08-24 -ls 2>/dev/null
We see all files that have changed between 20-08 and 24-08 (if needed we can change the range)
With that we can see interesting changes inside the boxes