Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to mft.

Collection

Format

AnalysisMembers

The operator set the clock, and set only one of them

Timestomping is a decision, not an accident, and the decision is visible. NTFS keeps eight timestamps per file and the ordinary Windows API writes four of them. What the other four say about the tool the operator chose, the checklist they were working from, and where they stopped.

9 Sept 20267 min readT1070.006T1070behavioral-tradecraft ntfs timestomp anti-forensics

Full write-up available to members subscribers. See what is included.