Glossary
Timestomping
An anti-forensic technique that alters a file's timestamps to hide when it was created, modified, or accessed.
Timestomping is an anti-forensic technique in which an attacker deliberately changes a file's timestamps to disguise its true history — for example, backdating a malicious tool so it blends in with legitimate system files. The goal is to break or mislead timeline analysis.
Most timestomping tools only rewrite the times in the $STANDARD_INFORMATION attribute, because that is what Windows APIs expose. The $FILE_NAME attribute, normally updated only by the kernel, is left untouched. Analysts therefore detect tampering by comparing $STANDARD_INFORMATION against $FILE_NAME: a creation time that is earlier in $STANDARD_INFORMATION than in $FILE_NAME is a strong red flag.
A second tell is sub-second precision: genuine NTFS timestamps carry 100-nanosecond granularity, but many tools set times truncated to whole seconds, leaving the fractional part as zeros.
See also MACB Timestamps.
Related artifacts
- $I30 index attributes$I30 cheat sheet: NTFS directory indexes ($INDEX_ROOT, $INDEX_ALLOCATION), INDX records, timestamps, slack entries of deleted files and parsers.
- $LogFile (NTFS transaction log)$LogFile cheat sheet: NTFS metadata journal (MFT record 2), 64 MB default, redo/undo operations, restart area, short retention and parsers.
- Master File Table ($MFT)$MFT cheat sheet: FILE records, $SI vs $FN timestamps, resident data, deleted records, sequence numbers, timestomping checks and MFTECmd parsing.
- PE files (Windows executables)PE file triage cheat sheet: hashes, imphash and Rich header, compile timestamp caveats, sections and entropy, version info, signatures, PDB paths and tools.
- ShimCache (AppCompatCache)ShimCache (AppCompatCache) cheat sheet: SYSTEM hive location, entry limits per Windows version, ordering, timestamp meaning and execution caveats.
- Sysmon Event LogSysmon cheat sheet: Operational log location, key event IDs, ProcessGuid and hash correlation, config in the registry, tampering signs and parsing tools.
- USN Journal ($UsnJrnl:$J)USN journal cheat sheet: $UsnJrnl:$J and $Max, record fields, reason flags, parent references, default size, rollover, fsutil and MFTECmd parsing.