Breaking Time: Methods, Artifacts, and Forensic Detection of Timestomping on FAT32, Ext3, and Ext4 File Systems

Breaking Time: Methods, Artifacts, and Forensic Detection of Timestomping on FAT32, Ext3, and Ext4 File Systems, published by SANS Institute in October 2025, tests how adversaries manipulate file timestamps on Linux file systems to hide malicious files, and what forensic evidence each method leaves behind. The research built a controlled virtual machine test environment across FAT32, Ext3, and Ext4 file systems to examine four common timestomping techniques: the touch command, the cp --preserve command, the debugfs tool, and system time manipulation ("time travel").

Key findings:

• The touch command can change a file's access and modified timestamps on any of the three file systems tested, but it cannot change the creation timestamp
• On Ext3 and Ext4, only the debugfs tool was able to change a file's creation (birth) and change timestamps; touch and cp --preserve could not alter either one
• FAT32 has no equivalent to debugfs, meaning full timestamp forgery, including the creation date, required combining the time-travel method with file move (mv) and touch operations
• Using debugfs to timestomp a file does not update the operating system's kernel cache, so the changed timestamps are visible in a raw disk image (via tools like FTK Imager) but not reflected in live commands like ls or stat until the file system is unmounted or the cache is cleared
• Debugfs unexpectedly failed to update a file's modified timestamp even while successfully changing the other three timestamps, an inconsistency the research flags as a potential detection signal since a modified time preceding a creation time is unusual, but the reverse is not
• Time-travel timestomping updates the operating system's live view of a file's timestamps immediately, but on Ext3 and Ext4 it made no corresponding changes to the raw disk data itself, a discrepancy the researcher could not fully explain and flags for further study
• Across all tested timestomping methods, the same four operating system files were consistently modified as indirect artifacts: the wtmp login log, two system journal files, and the random-seed file (the latter excluded as unrelated background noise)
• Time-travel activity left a distinctive indirect artifact: a new system journal file created and dated to the spoofed past timestamp, plus a recorded event showing the Network Time Protocol (NTP) service being disabled, even though no direct evidence of the time change itself appeared in the journal
• No system journal entries were found relating to the use of debugfs or umount, meaning these commands can alter file system metadata directly without generating typical operating system-level logging
• The .bash_history shell history file, often relied on as an investigative artifact, can be bypassed entirely if an SSH session is disconnected before the shell exits normally

The results show a consistent pattern: the simplest LOLBins (touch, cp) can convincingly fake access and modified timestamps but cannot touch creation or change timestamps on Ext3 and Ext4 without specialized tools, and those specialized tools introduce their own detectable inconsistencies between what the raw disk shows and what the live operating system reports. Time-travel is the most complete method for forging all four timestamps at once, but it leaves behind indirect artifacts, such as anomalous journal files and NTP service events, that persist even when the file system itself looks untouched. This means investigators who rely solely on file metadata will miss evidence that a broader, system-level review would catch. The research was conducted using isolated Ubuntu 24.02 virtual machines running VirtualBox, with FAT32, Ext3, and Ext4 file systems created and tested independently for each timestomping method. Direct file system artifacts were analyzed through hex-dump comparison and FTK Imager, while indirect operating system artifacts were identified by hashing and diffing full disk images before and after each timestomping event.