In this simulation, you will learn how to extract and interpret MAC (Modified, Accessed, Changed) timestamps in a Linux environment. Understanding file metadata is essential for establishing an accurate timeline of threat actor activity.
CHFI (312-49) Digital Forensics Simulation
Investigation Scenario
A corporate Ubuntu web server experienced a security breach. Suspecting a web shell deployment, the digital forensics team performed a logical acquisition of the /var/www/html/ directory, maintaining strict chain of custody protocols.
During the examination of the acquired disk image (mounted read-only to an analysis workstation), an investigator identifies a highly suspicious PHP file named update_module.php. To reconstruct the attack timeline, the investigator needs to determine the exact timestamp when the threat actor last triggered (accessed) this payload via HTTP requests.
Evidence Collected
Image File:web_server_var_www.dd Mount Point (Read-Only):/mnt/forensics/case404/ Target Artifact:/mnt/forensics/case404/html/uploads/update_module.php
The investigator opens a terminal to query the file's inode metadata to extract the precise MAC timestamps.
During a forensic examination of a Linux system, an analyst needs to determine the last time a specific file was accessed. Which command-line tool should the analyst use?
Forensic Hint: The standard ls -l command typically shows the Modification time (mtime). You need a command that parses the inode structure to present all three MAC timestamps (Modify, Access, Change) distinctly and clearly.
Expert Analysis
What the evidence shows: The terminal output clearly displays file metadata broken down into Access, Modify, and Change times. This level of granularity is pulled directly from the file's inode.
Forensic Stage: Examination & Analysis. The analyst is interacting with preserved, collected evidence (mounted read-only) to extract timeline details.
Why the correct answer is correct: The stat command queries the inode directly to display comprehensive file metadata. It explicitly shows the access time (atime), modification time (mtime), and change time (ctime), which is crucial for timeline reconstruction.
Why others are wrong:
ls -l: Displays the file listing but defaults to showing the modification time (mtime), not the access time (atime).
cat: Outputs the contents of the file. If executed on a live file system (without noatime), this would actively update the access time, destroying forensic evidence.
touch: A command used specifically to update access and modification times to the current time, or create an empty file. This constitutes data tampering/anti-forensics.
Real-world forensic action: An investigator will use stat on the web shell, note the Access Time (2026-04-09 23:14:02 UTC), and then pivot to the web server's access.log to search for HTTP GET/POST requests hitting update_module.php at that precise second. This correlates the executed shell with the attacker's source IP address.
MINI LESSON: MAC Times & Evidence Preservation
In Linux file systems (like EXT4), investigators rely on MAC times:
• Modified (mtime): Content of the file changed.
• Accessed (atime): File was read/opened.
• Changed (ctime): Metadata/inode data (like permissions or ownership) changed.
CRITICAL WARNING: Interacting with a live file system using native tools (like cat or vi) will alter the very MAC times you are trying to investigate. Always analyze a forensic image mounted with -o ro,loop,noatime flags to ensure the original timestamps are preserved and the chain of custody remains legally sound.