Timestomping
Definition
Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references. NTFS keeps two timestamp sets ($STANDARD_INFORMATION and $FILE_NAME) and many tools only modify the first set, which is the basis of the counter-move.
- Goal
- Falsify file system timestamps to mislead timeline analysis
- Canonical tool
- Metasploit's timestomp.exe; also SetMACE
- NTFS detail
- Two timestamp sets: $STANDARD_INFORMATION and $FILE_NAME
- Counter-move
- Comparing the two sets for inconsistency
Common questions
Why does comparing two NTFS timestamp sets expose timestomping?+
Most timestomping tools only rewrite the user-visible $STANDARD_INFORMATION timestamps and leave the harder-to-reach $FILE_NAME timestamps untouched. A mismatch between the two sets, where one shows a plausible history and the other does not, is a strong indicator of tampering.
Can timestomping be detected on file systems other than NTFS?+
Yes, but the method changes: examiners look for inconsistencies between file timestamps and other timeline sources that were not altered, such as event logs, prefetch entries, or file system journal records, since not every artefact touched by an incident gets its clock rewritten.
Related terms
- Anti-Forensics
- Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident...
- Cold-Boot Attack
- An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- USN Journal
- The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...