Share:
Glossary Forensics

Timestomping

Timestomping is deliberately changing a file's timestamps to hide when it was created or modified, a technique attackers use to blend in with older files.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

Investigators look for clues such as a file modified before it was created, timestamps rounded to whole seconds, or on NTFS a mismatch between the two sets of timestamps the file system keeps. Cross-checking with logs and other artefacts helps reveal the real timeline. See also Unix timestamp.

Try these tools

Log Forensics

Parse Windows Event Log (.evtx) files and text logs - syslog, auth.log/secure, Apache/nginx access and error logs.

Registry Forensics

Parse a Windows registry hive - SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat or Amcache.hve - entirely in your browser.

See also

  • Glossary Unix timestamp
    A Unix timestamp is the number of seconds since 00:00:00 UTC on 1 January 1970, the "Unix epoch".
  • Glossary Metadata
    Metadata is data about data: the hidden or secondary information a file carries about itself, such as its author, creation date.
  • Glossary Indicator of compromise (IOC)
    An indicator of compromise (IOC) is a piece of observable evidence, such as a file hash, IP address or domain.
Back to Glossary
AdSense Placeholder
Slot: footer_leaderboard