Timestomping

Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references. NTFS keeps two timestamp sets ($STANDARD_INFORMATION and $FILE_NAME) and many tools only modify the first set, which is the basis of the counter-move.