The practice of timestomping involves the deliberate alteration of timestamps, reshaping the perceived chronology of actions and potentially obscuring the true sequence of events.
Timestomp has the ability to modify or delete the accessed, created, modified and entry modified timestamp values on an NTFS system. These are also known as the MACE attributes or timestamp values.
