Meaning
A malicious alteration of file system timestamps represents a deliberate attempt to manipulate the temporal records of digital files. This timestomping changes the creation, modification or access dates to disguise when an event took place or to bypass security logs. It governs the analysis of digital evidence in corporate fraud investigations, and it stops applying when raw hardware logs or network captures are analyzed instead.
Forensic Deception
Changing the date of a file can make a newly created document look like it was written years ago to support a false claim. Forensic examiners check for timestomping by comparing the file metadata against the operating system logs and the master file table. Discrepancies between these different sources reveal that the timestamp has been adjusted.
Audit Risk
Trusting altered files can lead to wrong conclusions about when an intellectual property asset was created or when a transaction occurred. When timestomping is detected, the integrity of the entire record archive is compromised. This disruption requires the company to invest hours in verifying the timeline of their assets.
Defense Strategy
Storing critical file hashes on a decentralized ledger or a secure server prevents unauthorized changes to the timestamps. If a file does not match its recorded hash and date on the secure server, the modification is exposed immediately. This defense ensures that the timeline of events remains verifiable and secure.
