Implications of Timestamp Manipulation for Digital Forensics: Tools, Detection, and
Future Directions
(Somi Lim)
1
(Jihyeon Ryu)
2,*
-
(Korea University, 145, Anam-ro, Seongbuk-gu, Seoul 02841, Korea. limsomi79@gmail.com)
-
(Kwangwoon University, 20 Kwangwoon-ro, Nowon-gu, Seoul 01897, Korea. jhryu@kw.ac.kr)
Copyright © The Institute of Electronics and Information Engineers(IEIE)
Keywords
Timestamp manipulation, Timestomping, Anti-forensics, NTFS
1. Introduction
In digital forensic investigations, timeline reconstruction is a critical procedure
[1,
2]. The task of reconstructing a timeline of events and artifacts enables investigators
to comprehend the temporal progression of cybercrimes and derive conclusions in the
form of digital evidence, making it one of the most important yet challenging objectives
in digital forensics [3,
4]. In this process, timestamps provide a basis for systematically analyzing the sequence
of incidents by establishing the occurrence time of events and arranging them in chronological
order. However, if timestamps are manipulated, the course of the investigation may
be significantly altered. Therefore, timestamp manipulation is an important area of
study in digital forensics.
In recent years, numerous security incidents have demonstrated the use of antiforensic
techniques (e.g., evidence concealment and obfuscation) by malware and attackers to
evade analysis and detection [5,
6]. Among these, the timestamp technique, a timestamp manipulation method aimed at modifying
the recorded creation, access, and modification times within file system metadata,
distorts the chronological flow of events, thereby complicating timeline-based reconstruction
and causal attribution [7]. For example, in timeline analysis, if a specific malware execution event is followed
by a subsequent file event, the investigator may reasonably suspect that the file
was generated by the malware. However, if an adversary manipulates the creation time
of a file to appear earlier, the file may not be readily detected through timeline
analysis only [8]. Advanced Persistent Threat (APT) groups have incorporated time-stomping capabilities
into their malware, and this behavior has been documented in the MITRE ATT&CK framework
[9]. Well-known threat groups such as APT29 (Russia), APT32 (Vietnam), Lazarus (North
Korea), Chimera (China) employ this technique [10]. Moreover, timestamps are critical evidence for determining incident onset, malware
infiltration and propagation paths, and the timing of privilege escalation [11]. Thus, when their reliability is compromised, the accuracy of the forensic findings
and the admissibility of digital evidence in legal proceedings are directly affected.
The ease with which publicly available timestamp manipulation tools can modify timestamps
has led to challenges regarding the credibility of such evidence in court [12].
While existing literature provides a solid foundation for timestamp forensics, most
studies focus on individual tools and algorithms in isolation, often overlooking the
complex interactions between manipulation tactics and forensic environments. To bridge
this gap, this study systematically analyzes the impact of advanced timestamp manipulation
on digital investigations through a multi-faceted approach. First, we formalize the
behavioral patterns and tactical traces of widely used tools and APT groups, providing
a comprehensive threat landscape. Second, we synthesize diverse detection methods–ranging
from rule-based analysis of operating system artifacts (e.g., prefetch, event logs)
and file system artifacts (＄MFT, ＄LogFile) to algorithmic and AI-based approaches.
Third, we evaluate the practical efficacy of these methods across four distinct scenarios,
identifying their respective strengths and limitations and real-world investigate
contexts. Finally, we discuss current technical gaps and propose strategic directions
to guide future research in this evolving field.
2. Background Knowledge
2.1. NTFS Timestamps–MACE
The primary file system of the Windows operating system New Technology File System
(NTFS) [13] stores file time information as a 64-bit value representing the number of 100-nanosecond
intervals elapsed since January 1, 1601 (UTC) [14]. As shown in Table 1, the NTFS time information can be represented by four abbreviations: M for the last
modification time, A for the last access time, C for the file creation time, and E
for the last MFT entry update time [15].
Table 1. NTFS timestamp components.
|
Symbols
|
Timestamp
|
Description
|
|
M
|
Last modified time
|
Time when the file was last modified
|
|
A
|
Last accessed time
|
Time when the file was last accessed
|
|
C
|
File creation time
|
Time when the file was created
|
|
E
|
MFT entry update time
|
Time when the file’s ＄MFT entry was last updated
|
2.2. Operating System Artifacts in NTFS
A wide range of operating system (OS) artifacts is critical for identifying potential
timestamp manipulations in Windows. From the perspective of program execution, prefetch
files serve as a reliable source for determining execution times. Prefetch is a mechanism
that improves application launch performance by preloading portions of frequently
used programs when a computer boots [16].
In a similar vein, but focusing on file access rather than execution, LNK files are
artifacts that indicate that a file has recently been accessed and function as connectors
between executable files and applications [17]. By comparing the timestamps of an LNK file to those of its target file, investigators
can infer the likelihood of timestamp manipulation.
Furthermore, these file-level artifacts can be cross-referenced with event logs, which
provide critical evidence related to logins, authentication events, and the use of
accounts and privileges [18]. They reveal which user accounts were used and which systems were accessed, thereby
enabling the cross-verification of event log timestamps against file M or C times.
2.3. File System Artifacts in NTFS
File system (FS)-based detection techniques for timestamp manipulation leverage multiple
NTFS artifacts, most notably the Master File Table (＄MFT), which stores metadata for
all files and directories; the NTFS journal file (＄LogFile), which records transactional
updates; and the updated sequence number journal (＄UsnJrnl), which maintains a history
of file system changes.
The ＄MFT is a system file that stores the metadata for every file and folder in the
NTFS at the record level; the metadata for each file or folder may be stored in one
or more ＄MFT entries [19,
20]. As illustrated in Fig. 1, each entry is composed of a set of attributes, including various types such as ＄STANDARD_INFORMATION
(＄SI) and ＄FILE_NAME (＄FN). At the attribute level, MACE timestamps are represented
in the ＄SI and ＄FN attributes. The ＄SI attribute contains general file metadata such
as creation, access, modification times, and ownership information, whereas the ＄FN
attribute contains the file name and corresponding information, including its creation,
access, and modification timestamps [21]. Consequently, each file or directory in NTFS is associated with up to eight distinct
time values.
Fig. 1. ＄MFT architecture.
The ＄LogFile is a system file that maintains NTFS transaction metadata [19,
22]. It is primarily used to restore the file system to a consistent state after unexpected
events such as power failures. Transaction records in ＄LogFile include metadata changes
to files and directories stored in ＄MFT, enabling the reconstruction of file-level
events such as creation, deletion, moves, and renames [23].
The ＄UsnJrnl is a change journal that logs modifications to files and directories
within the file system [24]. Unlike the ＄LogFile, which is intended for recovery, ＄UsnJrnl emphasizes change-recording
and tracking for forensic and auditing purposes. Considering these complementary roles,
＄LogFile and ＄UsnJrnl can be leveraged to corroborate evidence and enable more precise
detection of timestamp manipulation within a file system.
3. Timestamp Manipulation Tool
Timestamp modification tools manipulate timestamps by altering the time values stored
in the file’s ＄SI and ＄FN attributes. Different tools exhibit distinct behavioral
patterns during execution, which can serve as forensic indicators for distinguishing
and attributing purposes. Consequently, formalizing tool-specific behavioral patterns
is important for reliable attribution and detection. In this report, we summarize
four commonly used timestamp manipulation tools and their characteristics in Table 2.
Table 2. Comparison of manipulation patterns by tool.
|
Feature
|
SFT-baseda
|
XTST
|
Timestomp
|
SetMACE
|
|
＄SI Mod.
|
O
|
O
|
O
|
O
|
|
＄FN Mod.
|
X
|
X
|
X
|
O
|
|
＄MFT Entry Mod.
|
X
|
X
|
O
|
O
|
|
100-ns precision
|
X
|
X
|
X
|
O
|
|
Used API
|
GetFileTime
SetFileTime
|
SetFileTime
|
ZwSetInfoFile
NtSetInfoFile
|
NtSetInfoFile
|
3.1. SetFileTime API based Tool
Timestamp manipulations can be performed programmatically using Windows API calls.
The APIs that are commonly used to read and write files are GetFileTime [25] and SetFileTime [26]. A common pattern combines the two APIs: an agent calls GetFileTime to read the MAC
values from one file, followed by SetFileTime to copy those values onto another file.
Importantly, SetFileTime cannot directly modify the timestamps contained in the ＄FN
attribute [27,
28]. Moreover, when finer-grained time components cannot be specified, unspecified subfields
are often zero-filled [29,
30]. Given that the E time cannot be directly set via SetFileTime, the following forensic
indicator is useful: if the 100-nanosecond subfields of the MAC timestamps in ＄SI
are zero and the corresponding E time is nonzero, this pattern strongly suggests the
use of a SetFileTime-based timestamp manipulation tool. Examples of utilities operating
in this manner include FileTouch.exe [31], chtime.exe [32], SKTimeStamp [33], NewFileTime [34], and BulkFileChanger [35]. As a representative example, Table 3 illustrates the specific timestamp manipulation pattern generated by FileTouch, where
the 100-nanosecond units are consistently reset to zero while the E time remains non-zero.
Table 3. Timestamp manipulation patterns using FileTouch: Analysis of zero-filled
100-nanosecond units.
|
Category
|
Normal
|
Anomaly
|
|
M
|
2026-01-11 06:10:24.8293062
|
2009-12-31 15:36:10.0000000
|
|
A
|
2026-01-11 06:10:24.8293062
|
2009-12-31 15:36:10.0000000
|
|
C
|
2026-01-11 06:10:08.2835190
|
2009-12-31 15:36:10.0000000
|
|
E
|
2026-01-11 06:10:24.8293062
|
2026-01-11 06:14:36.8197056
|
3.2. XTST
XTST [36] is also a timestamp manipulation utility based on the SetFileTime API [37,
38]. A notable behavior of this tool is that when only the data component is altered,
the millisecond field is preserved, whereas finer-grained subfields are cleared (i.e.,
set to zero). When both the date and time are modified, the timestamp can be adjusted
to millisecond resolution; however, the following three sub-millisecond digits are
populated with pseudo-random values unrelated to the original timestamp [39].
3.3. TimeStomp
At the 2005 Black Hat conference, James Foster and Vinnie Liu of the Metasploit project
introduced an antiforensic tool called Timestomp [40]. This tool employs the ZwSetInformationFile [41] and NtSetInformationFile [42] functions, which invoke the FILE_BASIC_INFORMATION structure to specify the handle
of the target file and apply modified timestamp values [29,
43]. This structure serves as a standard interface in the Windows environment for managing
essential file metadata, including various time-related and file attributes [44]. Unlike SetFileTime, the NtSetInformationFile function can modify not only the ＄SI-MAC
but also the E time [45]. However, similar to SetFileTime, it cannot directly modify the timestamps of the
＄FN attribute [29]. Nevertheless, by modifying the ＄SI values and relocating the file, the updated ＄SI
values are reflected in the ＄FN attribute, allowing indirect manipulation of ＄FN values
[46]. Specifically, when a file is moved to a different directory within the same partition
(e.g, via cut-and-paste or drag-and-drop operations), the NTFS mechanism updates the
＄FN attribute, thereby copying the current ＄SI values. After relocating, the adversary
modifies ＄SI again, and upon moving the file back to its original location, the ＄FN
timestamps are updated again to reflect the manipulated ＄SI values. Finally, the attacker
rewrites the desired values into the ＄SI, completing the timestamp manipulation process.
This procedure is illustrated in Fig. 2.
Fig. 2. ＄FN timestamp modification through folder relocation.
Previous research has indicated that Timestomp sets the 100-nanosecond component of
timestamps to a specific value [47]. In particular, the final seven digits that represent nanoseconds are always set
to zero and can serve as forensic indicators of timestamp manipulation. However, this
artifact was addressed in a later version, nTimeStomp [48], which supports full-timestamp manipulation down to 100-nanosecond precision in the
＄SI attribute [39,
49].
3.4. SetMACE
SetMACE, developed by Joskim Schicht [50], modifies both the ＄SI and ＄FN attributes via Windows API calls such as NtSetInformationFile
in versions up to 1.0.0.6 [49]. The method for altering the ＄FN attribute follows an established approach whereby
changes made to ＄SI are propagated into the ＄FN through file relocation [50]. SetMACE automates this process. Unlike several other timestamp manipulation tools,
it can modify timestamps with a precision of up to 100 ns [29,
46]. In subsequent releases (after versions 1.0.0.6) [50], SetMACE discontinued the use of APIs and instead employed direct disk writes [38,
46].
Starting with Windows Vista (NT 6.0), user-mode processes are no longer permitted
to gain direct access to the boot volume [51]. To overcome this limitation, SetMACE sets an SL_FORCE_DIRECT_WRITE flag before issuing
IRP_MJ_WRITE requests to the disk driver [29]. This allows the kernel-mode driver to bypass the cache and perform write operations
directly on the volume without unmounting it, enabling on-disk modifications, even
when the volume remains mounted.
4. Case Studies of Timestamp Manipulation Tactics in APT Groups
Timeline analysis is essential for digital forensics, but many APT groups now use
sophisticated techniques to manipulate timestamps and undermine its effectiveness.
Table 4. Comparison of timestamp manipulation techniques and their forensic impacts
by APT groups.
|
APT
|
Target artifacts
|
Techniques
|
Impact on investigation
|
|
APT29
|
Web Shells
|
Synchronizing the timestamp with adjacent legitimate files
|
Malicious files are excluded from the scope of investigation when sorted by C time
|
|
APT32
|
XML, Malicious Files
|
Backdating XML C times and cloning system library timestamps (e.g., kernel32.dll)
|
Misleads investigators into trusting malicious files by masquerading them as original
Windows installation files
|
|
Lazarus Group
|
Registry Keys, Malicious Files
|
Randomizing Registry M times and cloning timestamps from legitimate executables
|
Conceals traces of attack configurations and induces logical contradictions during
timeline analysis
|
|
Chimera
|
Malicious Files
|
Manipulation of timestamps using the Windows-compatible touch tool
|
Malicious DLLs bypass in-depth analysis by appearing as integral components of pre-existing
software
|
Table 4 summarizes the specific artifacts and methodologies utilized by prominent APT groups
for such purposes. Given that forensic practitioners typically prioritize the examination
of files whose creation or modification dates align with the estimated period of compromise,
APT groups strategically subvert this investigative methodology by intentionally distorting
temporal metadata.
APT29 [52] exploits this methodology by deploying a web shell onto a server and then synchronizing
its M and C times with those of legitimate files in the same directory [53-
55]. When a malicious file shares a similar temporal context with surrounding files,
it is highly likely to be excluded from the investigation’s priority list, despite
its critical role in the attack.
APT32 [56] employs a multi-stage approach. In the first stage, the C time of XML files is backdated
to a point prior to the actual attack. In the second stage, the timestamps of malicious
files are modified to match those of kernel32.dll, a core Windows system file [57-
59]. By mimicking the timestamps of system files, the group ensures that their malware
appears as legitimate system components that have been present since the initial Windows
installation.
Investigators also seek registry keys modified at the time of an incident. These artifacts
function as hierarchical containers that store not only application configuration
but also ’Last Write’ metadata, providing a critical temporal marker for forensic
analysis [60]. The Lazarus Group [61] randomizes these timestamps to make registry configurations appear unrelated to the
current attack, thereby causing confusion during timeline reconstruction. Furthermore,
they manipulate file metadata for temporal obfuscation, mirroring the temporal attributes
of legitimate system binaries (e.g., calc.exe, mspaint.exe, notepad.exe) to disguise
files created during the intrusion process [62-
65].
In Linux systems, the touch command is used to update file M and A times. The Chimera
[66] adopted a ported version of this utility within Windows environments to manipulate
the date the time metadata of malicious DLLs, thereby aligning them with the system’s
legitimate components [67].
These cases show that adversaries are moving beyond simple attribute changes. They
now manipulate the overall context of the incidents. Sophisticatedly replicated timestamps
closely mimic legitimate system libraries. This neutralizes evidence prioritization
and hinders investigators from securing core evidence on time. Investigators face
limits in combating these techniques unless they find logical inconsistencies between
diverse artifacts within the files system.
5. Timestamp Manipulation Detection Method
5.1. Rule Based Methods
As illustrated in Fig. 3, the rule-based approach utilizes a mutli-indicator framework. Rather than designating
a single rule violation as definitive proof of timestamp manipulation, a conclusive
determination is made only when a cluster of suspicious patterns is detected. This
approach is further categorized into rule-based operating system and rule-based file
system detection, depending on the specific forensic artifacts analyzed.
Fig. 3. Workflow of rule-based multi-indicator convergence for detecting timestamp
manipulation.
5.1.1 Operating System Artifacts Based Methods
Rule 1. Execution Traces of Timestamp Manipulation Tools When an application is executed, the corresponding prefetch file records metadata
such as the application name, execution count, time of the most recent execution,
and list-referenced files and libraries [68]. This behavior persists even when a timestamp manipulation tool is used. These tools
typically attempt to alter ＄FN timestamps by repeatedly relocating or executing the
target file, as illustrated in Fig. 2. Modifying the ＄FN timestamp requires multiple updates of ＄SI values. Consequently,
evidence of repeated execution of a program within a short period may indicate an
intentional attempt to manipulate timestamps. Thus, such execution patterns should
be treated as potential indicators of timestamp manipulation activity [49].
Rule 2. ＄SI Timestamp of an LNK File Link Files are shortcut files that store references for specific executables, folders,
documents, or network resources. In such LNK files, the values of ＄SI-A and ＄SI-E
must be approximately equal. When the user opens a file locally, the ＄SI-A and ＄SI-E
values of the associated LNK file are updated. Therefore, under normal circumstances,
the time difference between ＄SI-A and ＄SI-E timestamps of the file and its LNK file
should remain within a few seconds [49]. If the difference to minutes or hours, it may indicate possible manipulation of
the original file’s timestamps.
Furthermore, because LNK files cannot be created for nonexistent target files, their
C time should always postdate the original file’s ＄SI-C under normal conditions [49,
69].
Rule 3. Time-Tracking using Event Logs Event logs in the Windows record information related to security, system processes,
applications, and user activities. Among these, application and system logs are particularly
useful for detecting timestamp manipulations. If a file’s ＄SI-C or ＄SI-M value is
outside the period during which a user session is active, it may indicate the occurrence
of timestamp manipulation [49].
5.1.2 File System Artifacts Based Methods
Research has been conducted on detecting timestamp manipulations using the ＄MFT, ＄LogFile,
and ＄UsnJrnl files of the NTFS file system. These studies established a set of rules
to verify timestamp tampering.
Rule 1. Future Time The E time represents the point at which a user’s operation is completed. Therefore,
it cannot precede the M, A, or C time [5,
70]. Moreover, all timestamps in both ＄SI and ＄FN should logically be equal to or earlier
than the current system time. A timestamp recorded as a future time constitutes an
anomaly that cannot occur under normal conditions and may indicate forgery [5].
Rule 2. Relative Inconsistency between ＄SI and ＄FN Timestamps Most timestamp manipulation tools cannot modify ＄FN timestamps. This characteristic
can be leveraged to detect forgery by comparing the ＄SI timestamps with those of ＄FN.
If ＄SI-E is earlier than that of ＄FN, this is an evidence of manipulation [5]. The ＄SI-E value is frequently updated by operations such as copy, move, filename
modification, and file attribute modification [71]. While ＄FN-E is updated by similar operations, it is modified less frequently than
＄SI-E [70]. Therefore, under normal circumstances, ＄SI-E should be identical to or later than
＄FN-E. If ＄SI-E is earlier than ＄FN-E, there is a high temporal probability that the
＄SI value has been backdated relative to the ＄FN timestamp. Furthermore, when the
＄SI value is manipulated to a time prior to the original, a characteristic pattern
typically emerges where the ＄SI-MAC timestamps appear more recent than those of the
＄FN [5].
Table 5 presents the results of timestamp manipulation using the the nTimestomp tool [48]. When the timestamp is backdated to the past, the resulting anomaly aligns with the
pattern defined in Eq. (7). Conversely, when the ＄SI timestamp of a file is altered to a future date relative
to its original time, it follows the pattern described in Eq. (8).
Table 5. Illustrative comparison of the relative inconsistency between ＄SI and ＄FN
timestamps in Eq. (7) and (8).
|
Rule
|
Type
|
Attr.
|
M
|
A
|
C
|
E
|
|
Eq. (7)
|
Normal
|
＄SI
＄FN
|
2026-01-03 19:10:58
2026-01-03 19:09:45
|
2026-01-03 19:10:58
2026-01-03 19:09:45
|
2026-01-03 19:09:45
2026-01-03 19:09:45
|
2026-01-03 19:10:58
2026-01-03 19:09:45
|
|
Tampered
|
＄SI
＄FN
|
2026-01-03 18:58:53
2026-01-03 19:09:45
|
2026-01-03 18:58:53
2026-01-03 19:09:45
|
2026-01-03 18:58:53
2026-01-03 19:09:45
|
2026-01-03 18:58:53
2026-01-03 19:09:45
|
|
Eq. (8)
|
Normal
|
＄SI
＄FN
|
2026-01-03 17:37:13
2026-01-03 17:36:51
|
2026-01-03 17:37:13
2026-01-03 17:36:51
|
2026-01-03 17:36:51
2026-01-03 17:36:51
|
2026-01-03 17:37:13
2026-01-03 17:36:51
|
|
Tampered
|
＄SI
＄FN
|
2026-01-03 18:34:56
2026-01-03 17:36:51
|
2026-01-03 18:34:56
2026-01-03 17:36:51
|
2026-01-03 18:34:56
2026-01-03 17:36:51
|
2026-01-03 17:34:56
2026-01-03 17:36:51
|
Rule 3. ＄FN Timestamp Manipulation Most timestamp manipulation tools do not modify ＄FN timestamps; however, certain
utilities such as SetMACE can alter the ＄FN attribute.When an event occurs, the ＄FN-M
and ＄FN-E are always updated together [72]. Therefore, a discrepancy between ＄FN-M and ＄FN-E suggests possible timestamp tampering.
Furthermore, since additional data recording or metadata modification can only occur
after the file has been initialized, a logical temporal sequence must be maintained
[5,
72]. If the A or C times recorded in ＄FN are later than the M or E time, such an ordering
is anomalous and indicative of timestamp forgery.
Rule 4. 100-Nanosecond Unit of Timestamp Timestamp manipulation can also be identified by examining the 100-nanosecond component
of the timestamps. In a normal NTFS file, seven decimal digits representing the 100-nanosecond
intervals are preserved. There are two cases in which this value may appear to be
zero. The first is when a file created in the FAT file system is moved to NTFS. Given
that the FAT file system has lower temporal granularity than NTFS, it does not preserve
submicrosecond information [73]. The second case occurs when timestamps are manipulated using a timestamp manipulation
tool. In such instances, attackers may be unable to reproduce precise sub-nanosecond
values instead of inserting only integer-second values, which results in the 100-nanosecond
field being set to zero [5,
47].
Rule 5. The Correlation between ＄MFT and ＄LogFile. ＄LogFile is an NTFS journal that sequentially records metadata change events for
files and directories. If the file C time recorded in the ＄LogFile does not match
the C time stored in ＄MFT, it may indicate that an attacker has manipulated the C
time in either the ＄FN or ＄SI attributes [5].
Rule 6. The Correlation between ＄MFT and ＄UsnJrnl ＄UsnJrnl contains an event flag called BASIC_INFO_CHANGE, which indicates that the
metadata or timestamps of a file or directory have been modified [74,
75]. When file metadata is altered, the ＄SI-E value is updated accordingly [70]. Therefore, under normal circumstances, ＄SI-E should remain consistent with the BASIC_INFO_CHANGE
record. If such a record exists in ＄UsnJrnl, but the ＄SI-E value has not been updated,
this strongly suggests that a timestamp manipulation tool was used to selectively
alter the metadata [49].
Rule 7. Directory ＄MFT Entry Timestamp Within a directory’s ＄MFT entry, the attributes ＄INDX_ROOT and ＄INDX_ALLOCATION are
present. Each index entry contains the file name along with a subset of values copied
from the ＄FN attribute. These values include MACE timestamps. If any of these values
differ from the actual ＄FN timestamps of the corresponding file, the discrepancy can
be used as an indicator of timestamp manipulation [46].
Rule 8. Timestamp Comparison for Deleted Files When a file is deleted, its data are not immediately erased but rather remain unlinked
from the file system. Consequently, even after deletion, the metadata of the file
remain in the ＄MFT. If the ＄SI or ＄FN timestamps of a newly created file occupying
that space are set to a time earlier than the timestamps of the deleted file, this
can serve as evidence of forgery [5]. In this context, the ＄SI-MAC values of the new file are excluded because they can
be reset to preserved values through operations such as copy, decompression, backup,
or restoration, which may cause a high rate of false positives. Therefore, only the
＄MFT update time is considered [76,
77].
5.1.3 Taxonomy of Rule-based Detection
We systematize rule-based detection techniques by categorizing them into three primary
groups based on their underlying forensic logic, as presented in Table 6: Internal Consistency, Cross-Artifact Correlation, and Contextual Analysis. Internal
Consistency evaluates the logical integrity within a single artifact or a set of attributes
to verify whether the data itself is valid, which includes rules 1, 2, 3 and 4 in
the file system context. Cross-Artifact Correlation identifies discrepancies by cross-referencing
disparate metadata sources; operating system-based rule 2 and file system-based rules
5, 6, 7 are included in this category. Finally, Contextual Analysis validates the
legitimacy of timestamps through environmental traces, employing operating system-based
rule 1 and 3 and file system-based rule 8. By systematizing these methodologies, this
framework provides structured understanding of forensic detection principles that
transcends a simple list of artifacts.
Table 6. Classification of detection mechanisms for timestamp manipulation by operating
system and file system-based rules.
|
Mechanism
|
Description
|
Detection Rules
|
|
OS-based
|
FS-based
|
|
Internal consistency
|
Verifies logical integrity within a single artifact
|
–
|
1, 2, 3, 4
|
|
Cross-artifact correlation
|
Cross-validates multiple artifacts to identify discrepancies through comparative analysis
|
2
|
5, 6, 7
|
|
Contextual analysis
|
Verification of chronological consistency within the system environment
|
1, 3
|
8
|
5.2. Algorithm Based Method
An algorithmic approach was proposed in which inconsistencies or abnormal patterns
across artifacts are systematically analyzed to define detection rules, which were
then applied to determine the occurrence of manipulation. This method enables the
effective identification of tampering traces by verifying the consistency of temporal
information in file system metadata such as ＄MFT, ＄LogFile, and ＄UsnJrnl, while distinguishing
them from normal operations such as file creation, modification, and deletion.
Oh et al. proposed a journal-based detection algorithm utilizing file system metadata
in NTFS [8]. Their method precisely analyzed the variation patterns of ＄SI-C and ＄SI-M, incorporated
file system tunneling detection to eliminate false positives, and additionally leveraged
the unique anomaly in which 100-nanosecond fields are set to zero (as observed in
tools such as Timestomp). They further introduced cross-analysis techniques to enhance
the reliability of detection.
Song and Lee proposed another timestamp manipulation detection algorithm based on
the observation that Windows imposes an upper limit on the number of file write operations
per second on a storage device [78]. Their method calculated the difference between ＄SI-E and ＄SI-C, dividing it by the
file size to obtain an estimated file write speed; if the resulting value exceeded
the maximum read/write speed, the file was deemed to be manipulated. However, this
method is limited to specific operations, such as file copying or moving between volumes,
and becomes inapplicable when caching causes ＄SI-C and ＄SI-E to be identical.
6. Artificial Intelligence Based Method
With the advancement of Artificial Intelligence (AI), a growing trend has emerged
in applying AI across diverse domains, and research efforts have been extended to
timestamp manipulation detection. Mohamed and Khalid used ＄MFT files as features [79]. They extracted metadata such as filenames, extensions, file paths, and timestamps
from the ＄SI and ＄FN attributes, and converted raw time values to directly suitable
for machine learning into numerical feature values through preprocessing. Using a
binary logistic regression model, they determined whether file timestamps were manipulated.
A machine learning-based study by Oh extended the earlier rule-based detection framework
for timestamp forgery detection [80]. They constructed a dataset that simultaneously incorporated actual event logs from
＄UsnJrnl and file system states from ＄MFT. Based on groups of file operations performed
by specific programs over a given period, they derived statistical features such as
the ratio of file operations and the proportion of unchanged timestamps. They employed
machine learning models, including SVM, Decision Tree, Random Forest, and XGBoost,
to perform binary classification.
7. Comparative Analysis
7.1. Attack Scenario
These scenarios are categorized from 1 to 4 based on the attacker’s objective and
the sophistication of their anti-forensic measures.
-
Scenario 1 (Simple Attribute Modification) : This scenario involves the modification of the ＄SI attribute exclusively. The attacker
employs specialized utilities such as Timestomp or direct Windows API calls (e.g.,
SetFileTime) to overwrite the ＄SI timestamps with arbitrary values.
-
Scenario 2 (Dual-Attribute Manipulation) : In addition to the easily accessible ＄SI timestamp, the attacker concurrently modifies
the ＄FN attribute, a process that bypasses the limitations of standard administrative
APIs.
-
Scenario 3 (Mass Timeline Camouflage) : Unlike the previous cases, this scenario focuses on large-scale timeline manipulation.
The attacker batch-modifies the timestamps of all files within specific directories
to mimic legitimate user activity and blend in with normal system operations.
-
Scenario 4 (Rule-Evasion Anti-Forensics): This scenario employs sophisticated techniques designed to circumvent predefined
detection rules. By manipulating LNK file timestamps and deliberately deleting or
disabling critical system logs such as ＄UsnJrnl and ＄LogFile, the perpetrator effectively
obliterates the fundamental data required for deterministic forensic verification.
7.2. Performance Comparison
For a rigorous comparative evaluation, Table 7 defines four distinct scenarios to analyze the efficacy of rule-, algorithm-, and
AI-based detection methodologies.
Table 7. Comparative analysis of scenarios and detection methodologies.
|
Category
|
Scenario 1
|
Scenario 2
|
Scenario 3
|
Scenario 4
|
|
Primary Target
|
＄SI attributes
|
＄SI, ＄FN attributes
|
Bulk timestamps
|
LNK, ＄UsnJrnl, ＄LogFile
|
|
Attack Vector
|
Direct API overwrite
|
MFT sync.
|
Semantic mimicry
|
Rule-evasion
|
|
Detection Core
|
Consistency checks
|
Cross-validation
|
Statistical variance
|
Causality analysis
|
|
Optimal Approach
|
Rule-based
|
Rule-based
|
AI-based
|
AI-based
|
Scenario 1 (Simple Attribute Modification) In Scenario 1, a high detection rate can be achieved solely through rule-based methodologies,
as the manipulation is confined to the ＄SI attribute. Within the rule-based operating
system framework, suspicious activities can be identified via rules 1, 2, and 3. Furthermore,
the rule-based file system approach enables the detection of timestamp tampering through
rules 1, 2, 4, 5, 6, and 8.
While algorithm and AI-based detection models are capable of identifying such anomalies,
the deployment of these complex automated systems is often unnecessary for such primitive
cases. Given the deterministic nature of ＄SI modification, rule-based detection provides
the most efficient and computationally cost-effective solution without the need for
sophisticated heuristics or probabilistic analysis.
Scenario 2 (Dual-Attribute Manipulation) Scenario 2 represents a more sophisticated anti-forensic approach, involving the
modification of both ＄SI and ＄FN attributes. Since the ＄FN attribute is altered, traces
of manipulation can still be identified through rule 3 and rule 7 of the rule-based
file system framework. Therefore, traces of timestamp manipulation can potentially
be detected using a rule-based approach alone in this specific context. Furthermore,
similar to Scenario 1, while algorithmic and AI-based detection methods remain applicable,
they entail significantly higher computational costs and time overhead.
Scenario 3 (Mass Timeline Camouflage) Scenario 3 involves the large-scale manipulation of timelines across multiple files.
While rule-based methodologies may still be capable of determining whether individual
files have been tampered with, the cumulative computational overhead and time consumption
render rapid, real-time analysis impractical.
In contrast, algorithm and AI-based detection frameworks, being intrinsically automated,
can process massive datasets without such scalability issues. Furthermore, when manipulation
occurs on a large scale, it becomes virtually impossible for an attacker to perfectly
replicate the natural statistical distribution of an entire file system. Consequently,
AI-based approaches are optimized for identifying collective anomalies and detecting
sophisticated patterns of mass camouflage that deviate from legitimate system behavior.
Scenario 4 (Rule-Evasion Anti-Forensics) Since this scenario involves the obliteration of all the evidential data required
for detection, it significantly increases the difficulty for conventional detection
logic based on simple artifact comparison, rendering it nearly impossible to identify
through a rule-based approach alone. Existing algorithm-based methods, which primarily
focus on the automation of static, predefined rules, are also inadequate for capturing
such sophisticated evasions. In this context, it is imperative to conduct a deep-level
analysis of system-wide causality and logical contradictions among fragmented artifacts.
Therefore, an AI-based detection paradigm is more appropriate for this scenario. Unlike
traditional systems, AI-based approaches are not constrained by rigid, predefined
rules; instead, they autonomously learn non-linear correlations and latent features
among metadata. This capability enables for the effective identification of both previously
undisclosed manipulation techniques and complex evasion patterns that circumvent conventional
forensic frameworks.
8. Discussion
Rule-based methods suffer from limited efficiency and vulnerability to evasion tactics.
While algorithm-based approaches have improved detection progress efficiency, they
primarily function as automated tools rather than advancing core logical contractions,
or they are applicable only within a narrow scope. Conversely, AI-based approaches
offer superior performance in efficiency and pattern recognition, yet they lack the
forensic explainability required for practical implementation.
To overcome these limitations, a paradigm shift is required to structurally integrate
the strengths of each approach. The rule-based method provides deterministic reliability
by establishing physical inconsistencies as forensic evidence, while the AI-based
method offers scalability by identifying intelligent evasion patterns through the
learning of non-linear relationships within fragmented data. Consequently, there is
a critical need for a hybrid approach that unifies these complementary characteristics.
However, integrating these two distinct methodologies can significantly increase computational
complexity and processing time. To minimize computational overhead, the framework
uses a tiered verification process. The rule-based engine checks logical causality
only for anomalies flagged by the AI. Since perfectly synchronizing all system metadata
over time is not possible, the AI looks for subtle structural gaps. The rule-based
engine then reviews the sequence of artifacts in the identified area to provide deterministic
forensic reliability.
This approach represents a more pragmatic alternative then conventional Explainable
AI (XAI) [81] methods, which typically present the contribution of specific features as mere probabilities.
Considering the legal and practical specificities of timestamp forensics, a hybrid
detection model–where rule-based physical evidence corroborates AI analysis results–provides
significantly more robust reliability than relying solely on the probabilistic metrics
of XAI.
Table 8. Comparative analysis of detection methodologies for timestamp manipulation.
|
Criteria
|
Rule-based
|
Algorithm-based
|
AI-based
|
Hybrid
|
|
Theoretical complexity
|
O(1)
|
O(n)
|
O(nd)
|
O(1) → O(nd)
|
|
Forensic explainability
|
Very High
|
High
|
Low
|
Very High
|
|
Detection coverage
|
Limited
|
Moderate
|
Comprehensive
|
Optimal
|
|
Zero-day evasion resiliency
|
Infeasible
|
Infeasible
|
Very High
|
Very High
|
Table 8 provides a comparative analysis between traditional timestamp forgery detection paradigms
and the proposed hybrid approach. In terms of computational complexity, the rule-based
method is the most efficient, while AI-based and hybrid approaches exhibit higher
complexity. However, the proposed hybrid model offers superior forensic explainability
by integrating AI analysis with deterministic rule-based validation.
Regarding detection coverage, rule-based methods are limited to verifying specific
attribute consistencies within individual artifacts. In contrast, the hybrid model
expands the detection scope to the entire system’s behavioral context by leveraging
AI to identify latent correlations across heterogeneous data sources. By employing
rules to suppress false positives, the hybrid model provides a more robust detection
coverage than pure AI-based methods, which may otherwise include irrelevant system
noise in their analysis.
In terms of evasion resiliency, conventional rule-based or algorithm-centric studies
are often ineffective against attackers who recognize and bypass static rules. The
hybrid model, however, provides robust resiliency against sophisticated evasion attempts,
such as Scenario 4, by learning high-dimensional patterns to detect subtle logical
contradictions. Importantly, the rule-based component enhances this resiliency by
allowing investigators to back-trace which specific file system invariants deviated
from their expected behaviors.
Future research should focus on further refining the detection reliability through
an in-depth analysis of edge cases. Specifically, subsequent studies need to investigate
timestamp variations arising from legitimate system processes–such as major OS updates,
background indexing, or specific third-party software behaviors–that may inadvertently
mimic malicious manipulation. Formally defining these edge cases and integrating them
into the rule-based verification logic will be a primary objective for enhancing the
model. Such efforts will be critical for minimizing false positives and ensuring the
practical robustness of the detection model in complex, real-world forensic environments.
9. Conclusion
Malware and attackers can employ timestamp forgery to conceal malicious activities
or delay incident response investigations. Timestamp manipulation distorts the timeline
reconstruction process, which may cause digital forensic investigations to proceed
in directions that are inconsistent with the actual sequence of events. Therefore,
the issue of timestamp forgery stands as critical pillar in the integrity of digital
forensic investigations.
While existing studies have primarily focused on the advancement of individual algorithms,
they often overlook the complex interactions within diverse forensic environments.
To overcome these limitations, this research analyzes various timestamp manipulation
tools and investigates the specific techniques employed by actual APT groups. Furthermore,
this study systematically categorizes detection methodologies into three distinct
groups and evaluates their respective strengths, weaknesses, and technical constraints
through rigorous scenario-based analysis. Moving beyond the fragmented approaches
of previous literature, this research integrates diverse detection methodologies and
validates their effectiveness across various scenarios, thereby proposing a strategic
direction for future forensic practices. Such as comprehensive analysis provides a
practical guide for investigators to identify manipulation tools and attack patterns
in real-world environments as well as serves as a cornerstone for the development
of next-generation detection technologies.
References
F. Y. Loumachi , M. C. Ghanem , M. A. Ferrag , Advancing cyber incident timeline
analysis through retrieval-augmented generation and large language models, Computers,
Vol. 14, No. 2, Art. no. 67, 2025
C. Swenson , R. Phillips , S. Shenoi , Applying the Biba integrity model to
evidence management, Advances in Digital Forensics III, Vol. 242, pp. 231-244, 2007
S. Bhandari , V. Jusas , An abstraction-based approach for reconstruction of
timeline in digital forensics, Symmetry, Vol. 12, No. 1, Art. no. 104, 2020
B. Carrier , E. Spafford , An event-based digital forensic investigation framework,
Digital Investigation, 2004
D. Jang , G.-J. Ahn , H. Hwang , K. Kim , Understanding anti-forensic techniques
with timestamp manipulation, Proceedings of the 17th International Conference on Information
Reuse and Integration (IRI), pp. 609-614, 2016
J.-P. A. Yaacoub , H. N. Noura , O. Salman , A. Chehab , Digital forensics
vs. anti-digital forensics: Techniques, limitations and recommendations, arXiv preprint
arXiv:2103.17028, 2021
C. Vanini , C. Hargreaves , F. Breitinger , Evaluating tamper resistance of
digital forensic artifacts during event reconstruction, Digital Threats: Research
and Practice, Vol. 6, No. 4, pp. 1-16, 2025
J. Oh , S. Lee , H. Hwang , Forensic detection of timestamp manipulation for
digital forensic investigation, IEEE Access, Vol. 12, pp. 72544-72565, 2024
Timestomp (T1070.006), MITRE ATT&CK, [Online]. Available: https://attack.mitre.org/
techniques/T1070/006/. Accessed: Sep. 21, 2025., 2025
MITRE ATT&CK: Adversarial tactics, techniques, and common knowledge, MITRE ATT&CK,
[Online]. Available: https://attack.mitre.org/. Accessed: Sep. 21, 2025., 2025
C. Hargreaves , J. Patterson , An automated timeline reconstruction approach
for digital forensic investigations, Digital Investigation, Vol. 9, pp. S69-S79, 2012
M. J. Hannon , Metadata in civil and criminal discovery–Part II, The Computer &
Internet Lawyer, Vol. 35, 2018
R. Russon , Y. Fledel , NTFS documentation, Recuperado el, Vol. 1, pp. 2, 2004
B. Carrier , File System Forensic Analysis, Addison-Wesley Professional, 2005
X. Ding , H. Zou , Reliable time based forensics in NTFS, School of Software,
Shanghai Jiao Tong University, pp. 1-2, 2010
A. Ðuranec , D. Topolčić , K. Hausknecht , D. Delija , Investigating file
use and knowledge with Windows 10 artifacts, Proceedings of the 2019 42nd International
Convention on Information and Communication Technology, Electronics and Microelectronics
(MIPRO), pp. 1213-1218, 2019
A. Budhrani , U. Singh , B. Singh , Analysis of Windows 11 link file artifact
for evidence gathering, Proceedings of the 2022 International Conference on Futuristic
Technologies (INCOFT), pp. 1-6, 2022
N. Hashim , I. Sutherland , An architecture for the forensic analysis of Windows
system artifacts, Digital Forensics and Cyber Crime, pp. 120-128, 2011
Master file table and NTFS metadata files, Microsoft, [Online]. Available:
https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table. Accessed:
Sep. 24, 2025., 2025
X. Ding , H. Zou , Reliable time based forensics in NTFS, School of Software,
Shanghai Jiao Tong University, pp. 1-2, 2010
M. Kangas , Timestamp analysis in Windows OS file systems, 2025
J. Oh , S. Lee , H. Hwang , Forensic recovery of file system metadata for digital
forensic investigation, IEEE Access, Vol. 10, pp. 111591-111606, 2022
J. Oh , S. Lee , H. Hwang , NTFS data tracker: Tracking file data history based
on ＄LogFile, Forensic Science International: Digital Investigation, Vol. 39, Art.
no. 301309, 2021
fsutil usn–Manage the USN change journal, Microsoft, [Online]. Available:
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn.
Access- ed: Sep. 24, 2025., 2024
GetFileTime function (fileapi.h)–Win32 apps, Microsoft, [Online]. Available:
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getfiletime.
Accessed: Sep. 15, 2025., 2022
SetFileTime function (fileapi.h)–Win32 apps, Microsoft, [Online]. Available:
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-setfiletime.
Accessed: Sep. 15, 2025., 2022
H. Carvey , Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for
Windows 8, Elsevier, 2014
A. A. Bahjat , J. Jones , Deleted file fragment dating by analysis of allocated
neighbors, Digital Investigation, Vol. 28, pp. S60-S67, 2019
G.-S. Cho , A digital forensic analysis of timestamp change tools for Windows NTFS,
Journal of the Korea Society of Computer and Information, Vol. 24, No. 9, pp. 51-58,
2019
S. Neuner , A. G. Voyiatzis , M. Schmiedecker , E. R. Weippl , Timestamp
hiccups: Detecting manipulated filesystem timestamps on NTFS, Proceedings of the 12th
International Conference on Availability, Reliability and Security, pp. 1-6, 2017
FileTouch, Available: http://www.softtreetech.com/24x7/archive/47.htm. Accessed:
Sep. 15, 2025., 2025
chtime, [Online]. Available: https://github.com/Loadmaster/chtime-win32. Accessed:
Sep. 15, 2025., 2025
S. Küng , SKTimeStamp, [Online]. Available: https://tools.stefankueng.com/SKTimeStamp.html.
Accessed: Sep. 15, 2025., 2025
N. Hrg , NewFileTime, [Online]. Available:
https://www.softwareok.com/?seite=Microsoft/New FileTime. Accessed: Sep. 15, 2025.,
2025
N. Sofer , Bulk File Changer, [Online]. Available: https://www.nirsoft.net/utils/bulk_file_changer.html.
Accessed: Sep. 15, 2025., 2025
eXpress TimeStamp Toucher, [Online]. Available: https://www.softpedia.com/get/System/File-Management/TimeStamp-Toucher.shtml.
Accessed: Sep. 15, 2025., 2025
G.-S. Cho , Data hiding in NTFS timestamps for anti-forensics, The International
Journal of Internet, Broadcasting and Communication, Vol. 8, No. 3, pp. 31-40, 2016
H. Kwon , S. Lee , Digital forensic analysis of timestamp change tools: An anti-forensics
perspective, Forensic Science International: Digital Investigation, Vol. 33, Art.
no. 301013, 2020
S. Galhuber , R. Luh , Time for truth: Forensic analysis of NTFS timestamps,
Proceedings of the 16th International Conference on Availability, Reliability and
Security (ARES 2021), pp. 1-10, 2021
J. Foster , V. Liu , Catch me, if you can..., Black Hat USA 2005 Presentation,
2005
ZwSetInformationFile function (wdm.h), Microsoft, [Online]. Available: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwsetinformationfile.
Accessed: Jan. 8, 2026., 2023
NtSetInformationFile function, Microsoft, [Online]. Available: https://learn.micro
soft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntsetinformationfile. Accessed:
Sep. 15, 2025., 2025
M. Geiger , S. Zhu , Timestamp tampering and forensic detection, Computer and
Information Security Handbook, pp. 411-432, 2017
FILE_BASIC_INFORMATION structure (wdm.h), Microsoft, [Online]. Available:
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_file_basic_information.
Accessed: Jan. 9, 2026., 2024
J. Bouma , H. Jonker , V. van der Meer , E. Van Den Aker , Reconstructing
timelines: From NTFS timestamps to file histories, Proceedings of the 18th International
Conference on Availability, Reliability and Security (ARES '23), pp. 1-9, 2023
W. Minnaard , Timestomping NTFS, Master's thesis, University of Amsterdam, Amsterdam,
The Netherlands, 2014
Date forgery analysis and timestamp resolution, [Online]. Available: https://www.meridiandiscovery.com/articles/
date-forgery-analysis-timestamp-resolution/. Ac- cessed: Sep. 27, 2025., 2016
B. Lim , nTimetools: Timestomper and timestamp checker with nanosecond accuracy
for NTFS volumes, [Online]. Available: https://github.com/limbenjamin/nTimetools.
Accessed: Nov. 11, 2020., 2020
D. Palmbach , F. Breitinger , Artifacts for detecting timestamp manipulation
in NTFS on Windows and their reliability, Forensic Science International: Digital
Investigation, Vol. 32, Art. no. 300920, 2020
J. Schicht , SetMACE v1.0.0.6, Reboot Pro File Repository, [Online]. Available:
https://github.com/jschicht/SetMACE. Version 1.0.0.6; release date un- known. Accessed:
Sep. 20, 2025.
KB942448: Changes to the file system and to the storage stack to restrict direct
disk access and direct volume access in Windows Vista and in Windows Server 2008,
Microsoft, [Online]. Available: https://mskb.pkisolutions.com/kb/942448. Accessed:
Jan. 8, 2026., 2008
APT29, MITRE ATT&CK, [Online]. Available: https://attack.mitre.org/groups/G0016.
Accessed: Dec. 27, 2025., 2025
UNC3524: Eye spy on your email, [Online]. Available: https://www.mandiant.com/resources/blog/unc3524-
eye-spy-on-your-email. Accessed: Dec. 25, 2025., 2022
Supply chain compromise: Detecting APT activity from known TTPs, [On- line]. Available:
https://www.cisa.gov/sites/default/files/publications/Supply_Chain_Compromise_Detecting_APT_Activity_from_known_TTPs.pdf.
Accessed: Dec. 26, 2025., 2021
Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP
and Raindrop, Microsoft Security Blog, [Online]. Available: https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-
solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/. Accessed:
Dec. 26, 2025., 2021
APT32, MITRE ATT&CK, [Online]. Available: https://attack.mitre.org/groups/G0050.
Accessed: Dec. 27, 2025., 2024
N. Carr , Cyber espionage is alive and well: APT32 and the threat to global corporations,
[On- line]. Available: https://cloud.google.com/blog/topics/threat-intelligence/cyber-espionage-apt32/.
Accessed: Dec. 25, 2025., 2017
R. Dumont , Fake or fake: Keeping up with OceanLotus decoys, [Online]. Available:
https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/.
Ac- cessed: Dec. 25, 2025., 2019
R. Dumont , OceanLotus: macOS malware update, [Online]. Available: https://www.welivesecurity.com/2019/04/09/oceanlotus-
macos-malware-update/. Accessed: Dec. 25, 2025., 2019
H. Carvey , Windows Registry Forensics: Advanced Digital Forensic Analysis of the
Windows Registry, Elsevier, 2011
Lazarus group, MITRE ATT&CK, [Online]. Available: https://attack.mitre.org/groups/G0032.
Accessed: Dec. 27, 2025., 2025
Operation blockbuster: Unraveling the long thread of the Sony attack, [Online].
Available: https://www.operationblockbuster.com/resources/. Accessed: Dec. 26, 2025.,
2016
Operation blockbuster: Destructive malware report, [On- line]. Available: https://www.operationblockbuster.com/resources/.
Accessed: Dec. 26, 2025., 2016
Operation blockbuster: Loaders, installers and uninstallers report, [Online].
Available: https://www.operationblockbuster.com/resources/. Accessed: Dec. 26, 2025.,
2016
Kimsuky group's APT attacks using CHM (targeting internal documents of specific organizations),
ASEC Blog, [Online]. Available: https://asec.ahnlab.com/en/48223/. Accessed: Dec.
26, 2025., 2023
Chimera, MITRE ATT&CK, [Online]. Available: https://attack.mitre.org/groups/G0114.
Accessed: Dec. 27, 2025., 2024
W. Jansen , Abusing cloud services to fly under the radar, [Online]. Available:
https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/.
Accessed: Jan. 8, 2026., 2021
N. Shashidhar , D. Novak , Digital forensic analysis on prefetch files, International
Journal of Information Security Science, Vol. 4, No. 2, pp. 39-46, 2015
Windows forensic analysis evidence poster, Digital Forensics and Incident Response
(DFIR), [Online]. Available: https://www.sans.org/posters/windows-forensic-analysis/.,
2022
G.-S. Cho , A computer forensic method for detecting timestamp forgery in NTFS,
Computers & Security, Vol. 34, pp. 36-46, 2013
J. Bang , B. Yoo , S. Lee , Analysis of changes in file time attributes with
file manipulation, Digital Investigation, Vol. 7, No. 3-4, pp. 135-144, 2011
D.-Y. Kao , Forensic exchange analysis of contact artifacts on data hiding timestamps,
Applied Sciences, Vol. 10, No. 13, Art. no. 4686, 2020
File times–Win32 apps, Microsoft, [Online]. Available: https://learn.microsoft.com/en-us/windows/win32/sysinfo/file-times.
Accessed: Sep. 27, 2025., 2021
ntfs-usnjrnl Command Documentation, 2022
READ_USN_JOURNAL_DATA_V0 structure, Microsoft, [Online]. Available:
https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-read_usn_journal_data_v0.
Accessed: Sep. 27, 2025., 2018
Info-ZIP application note (appnote_iz.txt), [Online]. Available: https://libzip.org/specifications/appnote_iz.txt.
Accessed: Aug. 28, 2025., 2025
Restore files and directories–Security policy setting, Microsoft, [Online]. Available:
https://learn.microsoft.com/en-us/previous-versions/window s/it-pro/windows-10/security/threat-protection/secur
ity-policy-settings/restore-files-and-directories. Accessed: Aug. 28, 2025., 2025
J. Song , H.-S. Lee , A design of timestamp manipulation detection method using
storage performance in NTFS, Journal of Internet of Things and Convergence, Vol. 9,
No. 6, pp. 23-28, 2023
A. Mohamed , C. Khalid , Detection of timestamps tampering in NTFS using machine
learning, Procedia Computer Science, Vol. 160, pp. 778-784, 2019
J. Oh , A practical approach to detecting file timestamp manipulation for digital
forensic investigations, Expert Systems with Applications, Vol. 293, Art. no. 128630,
2025
D. Gunning , D. W. Aha , DARPA's explainable artificial intelligence (XAI) program,
AI Magazine, Vol. 40, No. 2, pp. 44-58, 2019
Somi Lim is currently a master degree in the School of Cybersecurity from Korea University.
She received her B.S. degree in computer information engineering from Kwangwoon University.
Her research interests include Digital Forensics, Cyber Crime Investigation, Anti-forensics.
Jihyeon Ryu is an assistant professor with the School of Computer and Information
Engineering, Kwangwoon University. She received her B.S. degree in mathematics and
computer science from Sungkyunkwan University, and a Ph.D. in cyber security from
Sungkyunkwan University, Korea. Her research interests include Cyber Security, Machine
Learning, and User Authentication.