Timestomping is a technique used to manipulate the timestamps associated with files on a computer system, such as the creation, modification, and access times, in order to conceal or alter the chronological history of a file's activity.
The practice of timestomping involves the deliberate alteration of timestamps, reshaping the perceived chronology of actions and potentially obscuring the true sequence of events.
Timestomp has the ability to modify or delete the accessed, created, modified and entry modified timestamp values on an NTFS system. These are also known as the MACE attributes or timestamp values.
