Comments on: Modify NTFS Timestamps and Cover Your Tracks With Timestomp.exe http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp Rendering computer investigations irrelevant Sat, 05 Nov 2011 19:36:26 +0000 hourly 1 http://wordpress.org/?v=3.3 By: admin http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp/comment-page-1#comment-437 admin Sat, 02 Apr 2011 00:25:44 +0000 http://www.anti-forensics.com/?p=125#comment-437 Thanks for the heads up :) I'll have to fix the link once metasploit hosts it again. Can't seem to find it. Thanks for the heads up :) I’ll have to fix the link once metasploit hosts it again. Can’t seem to find it.

]]> By: Nadja http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp/comment-page-1#comment-436 Nadja Fri, 01 Apr 2011 10:40:51 +0000 http://www.anti-forensics.com/?p=125#comment-436 The provided link to the timestomp.exe is not valid anymore. Maybe you want to change that. The provided link to the timestomp.exe is not valid anymore. Maybe you want to change that.

]]> By: loaded http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp/comment-page-1#comment-423 loaded Thu, 10 Feb 2011 21:52:22 +0000 http://www.anti-forensics.com/?p=125#comment-423 I attended a conference last year having to do with digital investigations and remember hearing something about Timestomp setting the times to xx:xx:0000 instead of xx:xx:(random #). Anyone had any experience with this to know if this is accurate or not? I attended a conference last year having to do with digital investigations and remember hearing something about Timestomp setting the times to xx:xx:0000 instead of xx:xx:(random #). Anyone had any experience with this to know if this is accurate or not?

]]> By: Benefits of using multiple timestamps during timeline analysis in digital forensics | Portable Digital Video Recorder http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp/comment-page-1#comment-282 Benefits of using multiple timestamps during timeline analysis in digital forensics | Portable Digital Video Recorder Wed, 18 Aug 2010 16:54:22 +0000 http://www.anti-forensics.com/?p=125#comment-282 [...] information for malicious actors on the tools and methods to modify timestamps is out there already and has [...] [...] information for malicious actors on the tools and methods to modify timestamps is out there already and has [...]

]]> By: Tami http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp/comment-page-1#comment-114 Tami Fri, 01 May 2009 22:48:57 +0000 http://www.anti-forensics.com/?p=125#comment-114 Very interesting site, Hope it will always be alive! Very interesting site, Hope it will always be alive!

]]> By: Yar http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp/comment-page-1#comment-74 Yar Thu, 16 Apr 2009 00:50:24 +0000 http://www.anti-forensics.com/?p=125#comment-74 Hey BG, I'm pretty sure there are not. I don't use FTK really so I can't be certain but it looks like you can make your own pretty easily. <a href="http://www.google.com/url?sa=t&source=web&ct=res&cd=1&url=http%3A%2F%2Fwww.accessdata.com%2Fmedia%2Fen_us%2Fprint%2Ftechdocs%2Ftechdoc.Importing%2520or%2520Adding%2520Hash%2520Sets%2520to%2520FTK.en_us.pdf&ei=YH_mSa72LI_wtAPL0bnmAQ&usg=AFQjCNH7A7cL8UZjoUoQ2HpyZvB5BqlZbQ&sig2=lAfJni2OXRW6w_SZviPUFg" rel="nofollow">Link (PDF)</a> However, you'd be out of luck if someone brought in a packed/compressed or otherwise modified timestomp.exe into a system. One which you don't have access to create a hash out of. Hey BG, I’m pretty sure there are not. I don’t use FTK really so I can’t be certain but it looks like you can make your own pretty easily. Link (PDF)

However, you’d be out of luck if someone brought in a packed/compressed or otherwise modified timestomp.exe into a system. One which you don’t have access to create a hash out of.

]]> By: mark http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp/comment-page-1#comment-72 mark Wed, 15 Apr 2009 22:21:31 +0000 http://www.anti-forensics.com/?p=125#comment-72 I rarely comment on blogs but yours I had to stop and say Great Blog!! I rarely comment on blogs but yours I had to stop and say Great Blog!!

]]> By: BG http://www.anti-forensics.com/modify-ntfs-timestamps-and-cover-your-tracks-with-timestomp/comment-page-1#comment-68 BG Sun, 12 Apr 2009 07:08:42 +0000 http://www.anti-forensics.com/?p=125#comment-68 Are there any KFF hash files for timestomp that might flag its use? Are there any KFF hash files for timestomp that might flag its use?

]]>