CHFI (312-49) Digital Forensics Simulation
Master timeline analysis and anti-forensics detection. This simulation trains you to identify manipulated file metadata and interpret NTFS Master File Table (MFT) attribute discrepancies.
Investigation Scenario
During an intellectual property theft investigation in San Jose, California, a forensic analyst acquired an image of a former engineer's workstation. The suspect is alleged to have copied highly sensitive schematic files just days before resigning.
When the analyst generates a timeline of file system activity (MAC times), the targeted schematic files appear to have been untouched since 2018. Suspecting anti-forensics activity to derail the timeline, the analyst parses the raw $MFT using Eric Zimmerman's MFTECmd to compare the attributes of the suspected file.
Evidence Collected
# Extracted via MFTECmd
Creation Time : 2018-05-12 10:15:22 UTC
Modification Time: 2018-05-12 10:15:22 UTC
MFT Record Change: 2023-10-24 08:45:10 UTC
Access Time : 2018-05-12 10:15:22 UTC
Creation Time : 2023-10-24 08:42:15 UTC
Modification Time: 2023-10-24 08:42:15 UTC
MFT Record Change: 2023-10-24 08:42:15 UTC
Access Time : 2023-10-24 08:42:15 UTC
Question
In a digital-forensics investigation in San Jose, California, an analyst is searching for evidence of anti-forensics activity. The analyst suspects that the user changed the metadata of a file to misguide the investigation. What is this type of anti-forensics technique called?
$STANDARD_INFORMATION MAC (Modified, Accessed, Created) timestamps show an older date (2018), while the $FILE_NAME attribute shows 2023. What is the specific term used when a suspect uses tools to "stomp" over system timestamps?
Expert Analysis
1. What evidence shows:
Analysis of the MFT record for the suspect file reveals a severe discrepancy. The $STANDARD_INFORMATION ($SI) attribute shows MAC times in 2018. However, the $FILE_NAME ($FN) attribute displays MAC times in 2023. This is a classic indicator of metadata manipulation.
2. Identify forensic stage:
Analysis - Performing timeline analysis and actively hunting for anti-forensics indicators within file system metadata structures.
3. Why correct answer is correct (A):
Timestomping is an anti-forensics technique where an attacker or malicious insider intentionally modifies the MAC (Modified, Accessed, Created) timestamps of a file. The goal is to break timeline analysis and hide malicious activities (like copying or modifying a file) from investigators by making the file appear old or untouched.
4. Why others are wrong:
- B (Wiping): Securely overwriting data so it cannot be recovered via data carving. Does not primarily target metadata timestamps.
- C (Encryption): Obfuscating the contents of a file using an algorithm and key. The file metadata (like size or MAC times) generally remains readable by the OS.
- D (Steganography): Hiding secret data within a non-secret file (e.g., hiding a schematic inside a JPEG image). This does not inherently involve altering creation timestamps.
5. Real-world forensic action:
When analysts suspect Timestomping, they never rely solely on standard Windows Explorer properties. They parse the Master File Table using tools like Plaso (log2timeline) or Zimmerman's MFTECmd. User-level tools easily alter the $SI attribute. However, the $FN attribute can typically only be altered by the system kernel. Finding a discrepancy where $FN is newer than $SI almost definitively proves the timestamps were intentionally manipulated.
MINI LESSON: MFT Attributes & Timestomping
- $STANDARD_INFORMATION (0x10): Contains standard MACB (Modified, Accessed, Created, Born) timestamps. Easily changed using Windows API functions (e.g., PowerShell, Timestomp).
- $FILE_NAME (0x30): Contains the file's name and its own set of MACB timestamps. These are typically updated only by the file system driver (kernel mode), making them highly reliable for forensic verification.
- The Golden Rule: If $FN timestamps are significantly *after* $SI timestamps, the file has likely been timestomped.