Lesson 1.39: File timelines and timestomping
Every file carries four times: access, modify, change and birth. Modify can be set to anything with touch -d, which attackers use to make a planted file look years old (timestomping). Change can't be set by any user command: the kernel moves it to now whenever content or metadata changes, including when touch rewrites modify. In the lab you list what changed during the attacker's session by modification time, then by change time, find the one file that only the second search reveals, and read the tells in its stat output.
19 min
You will learn to
- Explain atime, mtime, ctime and birth time
- Search a time window with find -newermt and -newerct
- Spot timestomping in stat output
- Link a changed file to how it runs
- Write a timeline
Key terms
- atime
- Last access (read). Often updated lazily (relatime).
- mtime
- Last change of the content; what ls -l shows. Settable with touch -d.
- ctime
- Last change of content or metadata (mode, owner, times). Set by the kernel to now; no user command can choose it.
- Birth time
- When the file (inode) was created; ext4 and XFS keep it, stat shows it.
- Timestomping
- Changing a file's times so it blends in.
- find -newerXY
- Compare time X of each file with time Y of a reference: -newermt DATE (modify), -newerct DATE (change).
← Deleted files that still fill the disk · All lessons · Hunting persistence with osquery →