Author: Rick Andrade

The goal of timestomping is to edit the timestamps being displayed and reported to the end user and incident responders in an attempt to make it seem as though the file doesn’t fall into the timeline of other detected malicious activity.

As investigators, part of our job includes providing an accurate account on the evidence recovered from the incident under investigation. Including details down to the look and feel of how a device is setup and how a user interacted with it goes a long way in providing the context needed for our casework. In the … Continued