Timestomping
Definition
Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references. NTFS keeps two timestamp sets ($STANDARD_INFORMATION and $FILE_NAME) and many tools only modify the first set, which is the basis of the counter-move.
Related terms
- Anti-Forensics
- Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident...
- Cold-Boot Attack
- An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- USN Journal
- The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...
Explained in
- Anti-Forensic Techniques and Investigator Counter-MethodsFalsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical referen...