Timestomping

The Art of Manipulating Time: An Introduction to Timestomping

In the digital realm, where every file, log entry, and system event carries a timestamp marking its moment in history, time itself becomes a malleable resource. The practice of timestomping involves the deliberate alteration of these timestamps, reshaping the perceived chronology of actions and potentially obscuring the true sequence of events. This manipulation of time can serve a variety of purposes, from the benign to the deeply malicious.

The Mechanics of Timestamps

To grasp the implications of timestomping, it’s essential to understand how timestamps function. At their core, timestamps serve as digital fingerprints, indicating when a file was:

• Created: The moment a file came into existence on a system.
• Modified: The last instance changes were saved to the file.
• Accessed: The last time a file was opened or read.

Modern filesystems, like NTFS on Windows, may track even more granular timestamps, such as the “birth” timestamp, marking an initial file copy onto the system. These timestamps are embedded within the file’s metadata, the data about data, providing a historical record accessible to those who know where to look.

Why Manipulate Time?

The motivations behind timestomping are diverse and often reflect the intent of the individual performing the act:

• Anti-Forensics & Obfuscation: Cybercriminals or those seeking to cover their tracks may employ timestomping to disrupt investigations. Altering the timestamps of incriminating files can make it harder to establish a timeline of activity, hindering efforts to unravel the who, what, and when of an incident.
• Evading Detection: Attackers might timestomp malware or tools to make them appear older, hoping they will blend in with legitimate system files and escape scrutiny by security software. Conversely, timestamps can be pushed into the future in an attempt to hide recent activity.
• Manipulating Evidence: In cases involving digital evidence, timestomping could be used to cast doubt on the authenticity of files or logs. Altering timestamps can potentially disrupt the chain of custody or plant misleading information within an investigation.
• Software Circumvention (Rare): Some older software relies on file timestamps for licensing or trial period restrictions. Timestomping might be used in an unethical attempt to bypass these mechanisms.

The Tools of the Trade

Timestomping can be carried out via a spectrum of methods, ranging from readily available operating system tools to specialized forensic utilities:

• Built-in OS Commands: Both Linux (with its touch command) and Windows (through PowerShell or command-line tools like SetMace) offer native ways to modify basic timestamps of files.
• Forensic Software: Tools like The Sleuth Kit, designed for in-depth file analysis, often include timestomping capabilities. This speaks to the double-edged nature of the technique—it can be used both for investigation and by those trying to subvert it.
• Specialized Timestomping Utilities: Various programs exist with the express purpose of manipulating timestamps with granular control.
• Hex Editors: For the utmost precision, raw file data can be edited using hex editors, allowing direct modification of timestamp values within their binary representation.

The Challenges and Limitations

While timestomping might seem like a way to erase digital footprints, it’s important to understand its limitations:

• Multiple Timestamps: Advanced filesystems store multiple timestamps. Simple tools might only affect one of these, leaving discrepancies that a skilled investigator can uncover.
• System Logs: Acts of timestamp modification may themselves get recorded in various system or application logs, providing clues about the tampering.
• Forensic Analysis: Forensic specialists are trained to look for inconsistencies in timestamps, file system anomalies, and traces of anti-forensic tools. Timestomping is rarely a foolproof method.

Linux

• touch: The primary command for modifying timestamps in Linux.
  • Syntax:touch -a -m -t [[CC]YY]MMDDhhmm[.ss] filename
    • -a changes only the access time
    • -m changes only the modification time
    • -t allows you to set a specific timestamp using the provided format.
  • **Example: ** touch -m -t 202312251035.00 myfile.txt (Sets modification time to Dec 25th, 2023, 10:35 AM)

Windows

• PowerShell: Provides a flexible way to manage timestamps.
  • Get Timestamp: (Get-ItemProperty filename).LastWriteTime
  • Set Timestamp: (Get-ItemProperty filename).LastWriteTime = "December 25, 2023 1:30 PM"
• SetMace: A specialized command-line utility for modifying MACE timestamps (Modification, Access, Creation, Entry).
  • Syntax: SetMace.exe filename [new dates and times]
  • Example: SetMace.exe report.doc -m 11/05/2023:12:00 -a 11/05/2023:13:40 -c 11/04/2023:22:15

Metasploit

metasploit timestomp

Important Notes

• Administrative Privileges: Timestamp modification often requires elevated permissions (administrator or root).
• Filename Wildcards: Some tools allow the use of wildcards (e.g., *.txt) to affect multiple files simultaneously.
• Beyond Basic Timestamps: Be mindful that NTFS stores additional timestamps. Some commands might not affect all of them.

Caveats and Considerations

• Logs: Traces of timestamp modifications may be left in system or file-level logs.
• Anti-Forensics: The use of timestomping tools can, in itself, be a sign of attempted concealment for an investigator.

Software

c# timestomping