Simple C# Timestomp

Timestomping a file is fairly simple in C#. Below, see that we check for a “method” argument which determines which MACE timestamp we modify on the filesystem (file modified/created).

SharpTimestomp sharpTimestomp = new SharpTimestomp(path, dateTime);

            if (method == "modified")
            {
                Console.WriteLine($"[>>>]Setting FileModified Date/Time: {sharpTimestomp.dateTime}");
                sharpTimestomp.setModified();
                Console.WriteLine($"[+] {path} - {method} date/time set successfully!");
            }
            else if (method == "created")
            {
                Console.WriteLine($"[>>>] Setting FileCreated Date/Time: {sharpTimestomp.dateTime}");
                sharpTimestomp.setCreated();
                Console.WriteLine($"[+] {path} - {method} date/time set successfully!");
            }
            else 
            { 
                sts.helpMessage();
            }

The meat involves these methods:

File.SetLastWriteTime(FilePath, DateTime);

and

File.SetCreationTime(FilePath, DateTime);

Simply provide a <file path> and a <date/time> value and the file attributes will be set.

SharpTimestomp.exe

SharpTimestomp.exe is a simple proof-of-concept timestomp application that modifies date/time values for the file indicated in the arguments.

Usage

SharpTimestomp.exe <file path> <date/time> <method>

SharpTimestomp.exe c:\test\test.txt "1/1/2022 10:00:01 AM" created

Where <date/time> is formatted like:

"1/1/2022 10:00:01 AM"

The methods:

created
modified

View the project on GitHub:

https://github.com/anti-forensics/sharptimestomp