File Timestamps & MAC Times

MAC times (Modified, Accessed, Created) are crucial metadata used in digital forensics to reconstruct a timeline of events on a compromised system.

The MAC Timeline

• Modified (mtime): Updated when the contents of the file are changed.
• Accessed (atime): Updated when the file is read. (Often disabled on modern OS for performance).
• Created (ctime/btime): Windows tracks creation time. Unix traditionally tracked 'Change time' (ctime - when metadata/permissions changed), but modern filesystems (ext4) track birth time (btime/crtime).

Timestomping

Attackers often manipulate these timestamps (a technique called "timestomping") to hide their malware in plain sight, setting the creation date of their malicious payload to match legitimate OS files (e.g., setting the date to the exact time the OS was installed).

Detection

Forensic analysts detect timestomping by looking for inconsistencies:

• MFT (Master File Table) records in NTFS contain two sets of timestamps (Standard Info and File Name attribute). Timestomping tools often only update one.
• A file that was modified before it was created.
• A compile timestamp inside the PE header that contradicts the file system timestamp.