thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Timestomping

An anti-forensics technique that alters file timestamps to blend malicious files in or mislead investigators.

Definition

Attackers set timestamps to match legitimate system files. Detection compares $STANDARD_INFORMATION and $FILE_NAME times, looks for zeroed sub-second values and correlates with other artifacts such as the USN journal. It is ATT&CK technique T1070.006.

Example

Malware set to the same creation date as kernel32.dll to avoid timeline scrutiny.

Exam tip

$SI vs $FN mismatch is the classic timestomping indicator.

Related terms