A threat actor uses 'timestomping' on a compromised Windows system. What forensic impact does this technique have?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because timestomping manipulates the $STANDARD_INFORMATION attribute timestamps (MACE: Modified, Accessed, Changed, Entry) to make malicious files appear to have been created at a different time, disrupting forensic timeline analysis; forensic countermeasure: compare $STANDARD_INFORMATION timestamps against $FILE_NAME timestamps (which are harder to manipulate). A is wrong because timestomping modifies metadata timestamps only, not file content encryption.
Full explanation below image
Full Explanation
B is correct because timestomping manipulates the $STANDARD_INFORMATION attribute timestamps (MACE: Modified, Accessed, Changed, Entry) to make malicious files appear to have been created at a different time, disrupting forensic timeline analysis; forensic countermeasure: compare $STANDARD_INFORMATION timestamps against $FILE_NAME timestamps (which are harder to manipulate). A is wrong because timestomping modifies metadata timestamps only, not file content encryption. C is wrong because removing MFT entries is a different anti-forensic technique; timestomping only changes timestamps, not MFT presence. D is wrong because overwriting free space is a separate anti-forensics technique (wiping); timestomping targets timestamp metadata.