What is timestamp manipulation?¶
The practical answer¶
Timestamp manipulation is the alteration of file or system times to make activity appear earlier, later or unrelated to the incident.
The key evidential caution¶
The dangerous assumption is that an unusual timestamp automatically proves deliberate tampering.
It may not.
Timestamps can change because of:
Key points¶
- file copying
- archive extraction
- synchronisation
- backup restoration
- software installation
- time-zone handling
- clock drift
- virtualisation
- application behaviour
An offender may alter timestamps to hide file creation, tool use or access.
Investigators should compare:
- creation, modification and access times
- file-system metadata
- application logs
- process creation
- download or transfer records
- archive metadata
- security telemetry
- system clock records
- provider timestamps
One timestamp should not be treated as definitive.
Different sources may record different aspects of the same event.
A file may retain an old modification time while being newly copied onto a system.
Where manipulation is suspected, look for tools, commands, metadata inconsistencies and impossible sequences.
Evidential limits¶
Do not assume timestamp alteration identifies who performed it.
The action may be automated or inherited through a copied archive.
Where timestamps differ, preserve the original time zone, clock source and any known drift. A system clock change may affect many records at once, while direct file manipulation may affect only selected items. That distinction can help identify the mechanism.
Archive extraction and file transfer can preserve or replace different timestamp fields. Record the source and destination file systems and the method used to move the file, because an apparently false date may be a normal consequence of transfer.
Operational takeaway¶
Correlate timestamps across file, process, application and system records, and describe manipulation only where the wider sequence supports deliberate alteration.