Anomalies: Count the Ghosts

An incident response team recovered a corrupted system log containing approximately 2,400 timestamped events. The recovery process preserved every record but scrambled their physical order.

Among the entries are three anomalous event classes: GHOST, WRAITH, and ECHO.

Internal notes suggest that the flag was embedded according to the true execution timeline, not the recovered file layout.

Restore the timeline, determine the correct record, and recover the flag.