Artifacts for Detecting Timestamp Manipulation in NTFS on Windows and Their Reliability. (April 2020)

• Record Type: Journal Article
• Authors: Palmbach, David; Breitinger, Frank
• Is Part Of: Forensic science international. Volume 32(2020)Supplement
• Publication Date: 2020-04
• Subjects: Timestamp manipulation -- Forgery -- $Logfile -- $USNJrnl -- SetMACE -- nTimestomp -- Timestomping -- Anti-forensics
• DOI: 10.1016/j.fsidi.2020.300920
• Languages: English
• ISSNs: 2666-2817

Abstract

Abstract: Timestamps have proven to be an expedient source of evidence for examiners in the reconstruction of computer crimes. Consequently, active adversaries and malware have implemented timestomping techniques (i.e., mechanisms to alter timestamps) to hide their traces. Previous research on detecting timestamp manipulation primarily focused on two artifacts: the $MFT as well as the records in the $LogFile . In this paper, we present a new use of four existing windows artifacts – the $USNjrnl, link files, prefetch files, and Windows event logs – that can provide valuable information during investigations and diversify the artifacts available to examiners. These artifacts contain either information about executed programs or additional timestamps which, when inconsistencies occur, can be used to prove timestamp forgery. Furthermore, we examine the reliability of artifacts being used to detect timestamp manipulation, i.e., testing their ability to retain information against users actively trying to alter or delete them. Based on our findings we conclude that none of the artifacts analyzed can withstand active exploitation.