How to Build a Timestomping Utility: Windows Native APIs & Forensic Evasion

Muhammad Zain-Ul-Abdin — Tue, 14 Jul 2026 09:35:07 +0000

How to Build a Timestomping Utility: Windows Native APIs, NTFS Metadata & Forensic Evasion

Title: How to Build a Timestomping Utility: Windows Native APIs, NTFS Metadata & Forensic Evasion

Description: Learn how file timestamps work in Windows, how they can be modified using Native APIs, and why forensic examiners need multiple data sources to catch manipulation.

Tags: #windows #cybersecurity #ntfs #native-api #forensics #c #malware-analysis #windows-internals

Reading Time: 8 min

Difficulty: Intermediate

🎯 Introduction

Ever wondered how malware hides its tracks on Windows systems? One of the most overlooked—yet powerful—techniques is timestomping: modifying file creation, modification, and access timestamps to appear innocuous.

In this post, I'll walk you through:

✅ How Windows stores file timestamps

✅ Why investigators rely on them

✅ How to build a timestomping utility from scratch

✅ Why timestomping alone is insufficient for evasion

✅ How forensic examiners can detect manipulation

I've built a working timestomper in C using Windows Native APIs—let's dissect it.

📋 The Problem: File Timestamps in Forensics

When an investigator reconstructs a timeline of events on a compromised system, they often start with file metadata.

Standard questions during incident response:

When was this executable created?
When was this configuration file last modified?
What files were accessed around the time of the breach?

All of this relies on three critical timestamps:

Timestamp	Meaning	Example
Creation Time	When the file was first written to disk	`2026-07-10 10:13 PM`
Last Write Time	When the file contents changed	`2026-07-10 10:15 PM`
Last Access Time	When the file was opened	`2026-07-10 3:00 PM`

If an attacker can modify these timestamps, they can:

🕵️ Hide when malware was executed
📅 Impersonate legitimate system files
🔄 Obfuscate the attack timeline
🚪 Evade automated detection systems

⚙️ Understanding Windows File Timestamps

Where Are Timestamps Stored?

Windows stores file timestamps in the NTFS MFT (Master File Table). Every file has an associated entry containing:

FILE_BASIC_INFORMATION
├── CreationTime
├── LastAccessTime
├── LastWriteTime
├── ChangeTime
└── FileAttributes

How Can We Access Them?

There are two ways to read/modify timestamps:

1. Win32 APIs (High-Level)

GetFileTime()    // Read timestamps
SetFileTime()    // Write timestamps (limited)

2. Native APIs (Low-Level)

NtQueryInformationFile()    // Query file info directly from kernel
NtSetInformationFile()      // Modify file info at kernel level

The Native API approach is more powerful because:

Win32 may enforce restrictions or validation
Native APIs interact directly with NTFS structures
Developers can bypass certain access checks

🔧 Building the Timestomper

Let's break down the implementation. Full source code: github.com/zainsial866/timestomper

Step 1: Define the Structures

typedef struct _FILE_BASIC_INFORMATION {
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    ULONG         FileAttributes;
} FILE_BASIC_INFORMATION;

The LARGE_INTEGER format stores time as 100-nanosecond intervals since January 1, 1601 (Windows FILETIME).

Step 2: Dynamically Resolve Native APIs

Instead of static linking, we resolve the APIs at runtime:

NtQueryInformationFile_t pNtQueryInformationFile = 
    (NtQueryInformationFile_t)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), 
        "NtQueryInformationFile"
    );

if (pNtQueryInformationFile == NULL) {
    printf("[!] Could not resolve NtQueryInformationFile\n");
    return FALSE;
}

Why?

Undocumented APIs aren't in import libraries
Dynamic resolution makes the tool more portable
Demonstrates runtime API patching techniques

Step 3: Open Source & Destination Files

HANDLE fileSrc = CreateFile(
    srcfile, 
    GENERIC_READ,          // Source needs read access
    0, NULL, OPEN_EXISTING, 0, NULL
);

HANDLE fileDst = CreateFile(
    dstfile,
    GENERIC_READ | GENERIC_WRITE | FILE_WRITE_ATTRIBUTES,  // Dst needs write
    0, NULL, OPEN_EXISTING, 0, NULL
);

Step 4: Query the Source File's Timestamps

IO_STATUS_BLOCK ioStat;
FILE_BASIC_INFORMATION src_fbi;

pNtQueryInformationFile(
    fileSrc,                          // File handle
    &ioStat,                          // Status block
    &src_fbi,                         // Output buffer
    sizeof(FILE_BASIC_INFORMATION),   // Buffer size
    FileBasicInformation              // Information class
);

Step 5: Copy Timestamps

FILE_BASIC_INFORMATION dst_fbi;

// Get destination file's current metadata
pNtQueryInformationFile(fileDst, &ioStat, &dst_fbi, 
                        sizeof(FILE_BASIC_INFORMATION), FileBasicInformation);

// Replace timestamps
dst_fbi.LastWriteTime = src_fbi.LastWriteTime;
dst_fbi.LastAccessTime = src_fbi.LastAccessTime;
dst_fbi.ChangeTime = src_fbi.ChangeTime;
dst_fbi.CreationTime = src_fbi.CreationTime;

Step 6: Write Modified Metadata Back

pNtSetInformationFile(
    fileDst,                          // File handle
    &ioStat,                          // Status block
    &dst_fbi,                         // Modified structure
    sizeof(FILE_BASIC_INFORMATION),   // Buffer size
    FileBasicInformation              // Information class
);

🎬 How It Works (Flow)

┌─────────────────────────────────────────────────┐
│ SOURCE FILE                DESTINATION FILE     │
│ (kernel32.dll)             (malware.exe)        │
└─────────────┬──────────────────────┬────────────┘
              │                      │
              ↓                      ↓
        ┌──────────────┐      ┌──────────────┐
        │ Query        │      │ Query        │
        │ Timestamps   │      │ Timestamps   │
        └──────┬───────┘      └──────┬───────┘
               │                     │
               ↓                     ↓
        ┌──────────────┐      ┌──────────────┐
        │ CreationTime │      │ CreationTime │
        │ LastAccess   │      │ LastAccess   │
        │ LastWrite    │      │ LastWrite    │
        └──────┬───────┘      └──────┬───────┘
               │                     │
               └─────────┬───────────┘
                         ↓
                   COPY TIMESTAMPS
                         ↓
                  ┌──────────────┐
                  │ SetFileInfo  │
                  │ Write Back   │
                  └──────┬───────┘
                         ↓
                    ✅ SUCCESS

📊 Real-World Lab Results

I tested this on Windows 10/11. Here's what happens:

Before Timestomping:

C:\> dir /tc test.txt
07/10/2026 10:13 PM

C:\> dir /tw test.txt
07/10/2026 10:15 PM

After timestomping (using kernel32.dll as source):

C:\> dir /tc test.txt
04/30/2026 10:30 PM

C:\> dir /tw test.txt
04/30/2026 10:30 PM

The file now appears to have been created and modified in April—months ago—even though we modified it today.

🚨 Why Timestomping Alone Doesn't Work

Here's the critical part: timestomping is easily detected by forensic examiners.

Why Timestamps Can't Be Trusted Alone

Creation Time < Last Write Time
- If a file's creation time is after its last write time, something is wrong
- Legitimate behavior: Creation ≤ Last Write (always)
The NTFS USN Journal
- NTFS maintains a Change Journal recording all file modifications
- This journal is harder to modify than file timestamps
- Forensic examiners cross-reference timestamps with USN entries
Event Logs
- Windows logs application behavior in Event Viewer
- A process execution is recorded regardless of file timestamps
- Malware execution can be tied to specific processes
Link Files & Prefetch
- Windows creates .lnk files with accurate timestamps
- Prefetch files (C:\Windows\Prefetch\) log application execution
- These are harder to modify than file times
MFT Analysis
- The Master File Table stores multiple timestamp variations
- Some entries are resistant to modification
- Examiners compare MFT entries with user-visible timestamps

How Forensic Examiners Detect Timestomping

Timeline:
├── File timestamps: April 30
├── USN Journal: July 10 ✅ MISMATCH
├── Windows Event Log: July 10 ✅ MISMATCH
├── Prefetch: July 10 ✅ MISMATCH
└── MFT Record: July 10 ✅ MISMATCH

CONCLUSION: Timestamps are forged

🛡️ Forensic Recommendations

If you're on the defense side, here's how to strengthen your detection:

Collect Multiple Data Sources

   ✅ File timestamps
   ✅ USN Journal
   ✅ Windows Event Logs
   ✅ Prefetch files
   ✅ Link files
   ✅ MFT analysis
   ✅ Application logs

Monitor File Modifications
- Use File Integrity Monitoring (FIM) tools
- Alert on suspicious timestamp changes
- Correlate with process execution logs
Hardening
- Implement filesystem auditing
- Enable USN Journal on critical partitions
- Use WDAC (Windows Defender Application Control) to restrict executable creation
- Monitor ntdll.dll function calls (suspicious if processes call NtSetInformationFile)

🎓 Technical Concepts You'll Learn

By studying this code, you'll understand:

✅ Windows Internals

NTFS file system structures
Master File Table (MFT)
File timestamps and their representations

✅ Native APIs

How Win32 abstracts the kernel
Undocumented API usage
Dynamic API resolution

✅ Forensics & Incident Response

Timeline reconstruction
Artifact correlation
Evidence integrity checks

✅ Malware Analysis

Common evasion techniques
Timestamp manipulation detection
Attribution challenges

🔗 Resources & Further Reading

Windows Internals:

Forensics:

NTFS Deep Dive:

Malware Analysis:

📦 Full Repository

Check out the complete working code:

GitHub: zainsial866/timestomper

What's included:

✅ Complete C source code
✅ Detailed README with examples
✅ Lab notes documenting behavior
✅ Header files with structure definitions
✅ Compilation instructions

⚖️ Legal & Ethical Note

This tool is for educational purposes and authorized security research only.

Modifying file timestamps without authorization may violate:

🛑 Computer Fraud & Abuse Act (CFAA)
📜 Evidence tampering laws
🔒 Your organization's security policy

Always get explicit authorization before testing on any system.

🎯 Conclusion

Timestomping is a powerful technique that demonstrates:

How easily file metadata can be modified
Why forensic investigators use multiple data sources
The importance of understanding Windows internals
How attackers hide their footprints

But it's also a reminder that no single artifact tells the whole story. Modern incident response requires correlation across logs, events, and file system metadata.

If you're building a SOC, hunting for threats, or just curious about Windows internals—understanding timestomping is critical.

Have thoughts on forensics, Windows internals, or cybersecurity? Drop a comment below. 👇

Want to see more deep dives like this? Follow for more technical content on offensive security, Windows research, and malware analysis.

About the Author

I'm a cybersecurity student at SS-CASE-IT focusing on offensive security, Windows internals, and tool development. I post technical content on GitHub and maintain a blog covering CTF writeups, security research, and system internals.

Connect with me:

🐙 GitHub
🔗 LinkedIn

Last updated: July 2026

DEV Community: Muhammad Zain-Ul-Abdin