Breaking Time: Methods, Artifacts, and Forensic Detection of Timestomping on FAT32, Ext3, and Ext4 File Systems

Hiding malicious files is imperative to breach a computer system successfully. To conceal malicious files among legitimate ones and complicate forensic investigations, adversaries often employ timestomping, which is the manipulation of file timestamps, as a defense evasion technique.

This paper explores the diverse methods used to timestomp files on FAT, Ext3, and Ext4 file systems, focusing on how adversaries adapt their approaches based on available system access and permissions. The direct and indirect forensic artifacts left behind by these methods are analyzed, providing a framework to help investigators identify likely timestomping techniques.

By correlating artifacts with specific adversary capabilities, this research supports faster and more accurate detection, enhancing incident response efforts on Linux systems.