The operator set the clock, and set only one of them
Timestomping is a decision, not an accident, and the decision is visible. NTFS keeps eight timestamps per file and the ordinary Windows API writes four of them. What the other four say about the tool the operator chose, the checklist they were working from, and where they stopped.
An operator who changes a file's timestamps has told you three things before
you have looked at a single artefact. They knew you would build a timeline.
They knew which file mattered. And they had enough time on the host to do
housekeeping, which means they were not being chased.
That is worth more than it sounds. Most of what an intrusion leaves behind is a
by-product. A process ran, a registry key was written, a socket opened.
Timestomping is not a by-product. It is a deliberate act with a target, and the
target is the artefact the operator thought you would find.
What the operator actually controls
NTFS stores file timestamps in two places, not one.
The operator set the clock, and set only one of them · Security Artifacts
