Indicators of compromise · Question 12 of 12
During an investigation, system files show a modification date from 2009 but, according to the file system journal, were written yesterday. What does this suggest?
1 answer is correct. Hard
Show answer
Answer
- A Timestomping, i.e. manipulated timestamps
Explanation
Attackers change timestamps so that their files do not stand out among old system files. Contradictions between file times and the journal or other sources are therefore an important indicator. Forensic analysts compare several time sources.