A threat actor uses 'timestomping' on a compromised Windows system. What forensic impact does this technique have?
Select an answer to reveal the explanation.
Short Explanation
Timestomping messes with a file’s $STANDARD_INFORMATION timestamps so malicious files look older or newer than they really are. You’ll see it disrupt timeline analysis because the creation and modification times no longer match the attack. Compare those timestamps with $FILE_NAME timestamps to spot the tampering.
Full Explanation
The correct forensic impact is that timestomping modifies the $STANDARD_INFORMATION timestamps of files to hide when malicious files were created or modified, disrupting timeline analysis. Timestomping manipulates the $STANDARD_INFORMATION attribute timestamps (MACE: Modified, Accessed, Changed, Entry) to make malicious files appear to have been created at a different time, disrupting forensic timeline analysis; a forensic countermeasure is to compare $STANDARD_INFORMATION timestamps against $FILE_NAME timestamps, which are harder to manipulate. The option describing encryption of file contents to prevent forensic analysis is wrong because timestomping modifies metadata timestamps only, not file content encryption. The option describing removal of files from the MFT to prevent recovery by forensic tools is wrong because removing MFT entries is a different anti-forensic technique; timestomping only changes timestamps, not MFT presence. The option describing overwriting free disk space to prevent file carving recovery is wrong because overwriting free space is a separate anti-forensics technique (wiping); timestomping targets timestamp metadata.