Timestamp Discrepancy and Suspected Timestomping
A Windows 10 laptop is seized from an employee suspected of copying trade secrets to a personal USB drive. The examiner images the drive and finds a folder C:\Projects\Alpha with files whose $STANDARD_INFORMATION creation timestamps are 2020-01-01 00:00:00, while $FILE_NAME timestamps are 2023-06-14 14:22:10. The $UsnJrnl shows a gap between 2023-06-14 14:20 and 14:30. Prefetch for powershell.exe is missing, but $MFT shows the file was created on 2023-06-14. Event logs show a logon at 14:15 and a USB device connected at 14:35. The suspect claims he never accessed the folder. The case agent asks whether this proves anti-forensics. The laptop was running when seized; the examiner performed a live acquisition of memory before imaging the disk, and the memory image shows no powershell.exe process at capture time.
1. Interpret the timestamp discrepancy. What does it suggest, and what does it not prove?
Read the worked answer
Reasoning: In NTFS, $STANDARD_INFORMATION timestamps are user-mode accessible and can be changed by APIs, while $FILE_NAME timestamps are maintained by the kernel and are generally harder to alter. A large discrepancy, especially a suspicious round value such as 2020-01-01 00:00:00, is consistent with timestomping. The $UsnJrnl gap around the same period and the missing powershell.exe prefetch add corroborating suspicion.
However, this does not prove the suspect accessed the folder. File copy, backup, restore, installer behavior, or application-level metadata can also produce $STANDARD_INFORMATION and $FILE_NAME differences. The memory image showing no powershell.exe at capture time is also not conclusive; the process may have exited earlier.
The correct conclusion is 'consistent with anti-forensics and requiring corroboration,' not 'proves timestomping.' The examiner should avoid overstating the finding to the case agent.
2. What corroborating artifacts would you examine, and how would each support or refute the hypothesis?
Read the worked answer
Reasoning: The examiner should look for independent records of file activity. $UsnJrnl records can show creates, writes, renames, and deletions around 14:20-14:30; a gap may support deliberate journal clearing, but it could also result from volume or system behavior. $LogFile and $MFT can show metadata changes and file creation. Security event logs may show logon, object access, or process creation if auditing was enabled. USB registry keys and event logs can confirm the USB connection at 14:35 and may identify the device.
Prefetch, Shimcache, and Amcache can show whether powershell.exe or other tools ran, though absence is not proof of execution. PowerShell operational logs, LNK files, jump lists, and browser history may place the user in the folder or show archive creation. Volume shadow copies or backups may preserve earlier metadata.
Each artifact should be evaluated for what it can and cannot show. Together they may support or refute the hypothesis, but no single artifact should be treated as conclusive.
3. How should the examiner present the findings in a report without overstating?
Read the worked answer
Reasoning: The report should separate observations, interpretation, and limitations. Observations include the exact $STANDARD_INFORMATION and $FILE_NAME values, the $UsnJrnl gap, the missing prefetch, the logon and USB timestamps, and the memory result. Interpretation should say the pattern is 'consistent with timestomping' or 'suggests deliberate timestamp alteration,' not 'proves the suspect copied files.'
The report should list alternative explanations, such as file copy, backup restoration, or application behavior, and explain why they are more or less likely. It should describe the tools and versions used, the hashes of the images, and any validation steps. If the evidence is circumstantial, the report should say so.
The examiner should also avoid attributing activity to a person based only on timestamps. User attribution requires corroborating logon, process, or physical evidence. A measured report preserves credibility and helps the case agent understand the strength of the finding.