How to Build a Timestomping Utility: Windows Native APIs & Forensic Evasion

How to Build a Timestomping Utility: Windows Native APIs, NTFS Metadata & Forensic Evasion

Title: How to Build a Timestomping Utility: Windows Native APIs, NTFS Metadata & Forensic Evasion

Description: Learn how file timestamps work in Windows, how they can be modified using Native APIs, and why forensic examiners need multiple data sources to catch manipulation.

Tags: #windows #cybersecurity #ntfs #native-api #forensics #c #malware-analysis #windows-internals

Reading Time: 8 min

Difficulty: Intermediate

---

🎯 Introduction

Ever wondered how malware hides its tracks on Windows systems? One of the most overlooked—yet powerful—techniques is timestomping: modifying file creation, modification, and access timestamps to appear innocuous.

In this post, I'll walk you through:

✅ How Windows stores file timestamps

✅ Why investigators rely on them

✅ How to build a timestomping utility from scratch

✅ Why timestomping alone is insufficient for evasion

✅ How forensic examiners can detect manipulation

I've built a working timestomper in C using Windows Native APIs—let's dissect it.

---

📋 The Problem: File Timestamps in Forensics

When an investigator reconstructs a timeline of events on a compromised system, they often start with file metadata.

Standard questions during incident response:

• When was this executable created?
• When was this configuration file last modified?
• What files were accessed around the time of the breach?

All of this relies on three critical timestamps:

Timestamp	Meaning	Example
Creation Time	When the file was first written to disk	2026-07-10 10:13 PM
Last Write Time	When the file contents changed	2026-07-10 10:15 PM
Last Access Time	When the file was opened	2026-07-10 3:00 PM

If an attacker can modify these timestamps, they can:

• 🕵️ Hide when malware was executed
• 📅 Impersonate legitimate system files
• 🔄 Obfuscate the attack timeline
• 🚪 Evade automated detection systems

---

⚙️ Understanding Windows File Timestamps

Where Are Timestamps Stored?

Windows stores file timestamps in the NTFS MFT (Master File Table). Every file has an associated entry containing:

FILE_BASIC_INFORMATION
├── CreationTime
├── LastAccessTime
├── LastWriteTime
├── ChangeTime
└── FileAttributes

How Can We Access Them?

There are two ways to read/modify timestamps:

1. Win32 APIs (High-Level)

GetFileTime()    // Read timestamps
SetFileTime()    // Write timestamps (limited)

2. Native APIs (Low-Level)

NtQueryInformationFile()    // Query file info directly from kernel
NtSetInformationFile()      // Modify file info at kernel level

The Native API approach is more powerful because:

• Win32 may enforce restrictions or validation
• Native APIs interact directly with NTFS structures
• Developers can bypass certain access checks

---

🔧 Building the Timestomper

Let's break down the implementation. Full source code: github.com/zainsial866/timestomper

Step 1: Define the Structures

typedef struct _FILE_BASIC_INFORMATION {
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    ULONG         FileAttributes;
} FILE_BASIC_INFORMATION;

The LARGE_INTEGER format stores time as 100-nanosecond intervals since January 1, 1601 (Windows FILETIME).

Step 2: Dynamically Resolve Native APIs

Instead of static linking, we resolve the APIs at runtime:

NtQueryInformationFile_t pNtQueryInformationFile = 
    (NtQueryInformationFile_t)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), 
        "NtQueryInformationFile"
    );

if (pNtQueryInformationFile == NULL) {
    printf("[!] Could not resolve NtQueryInformationFile\n");
    return FALSE;
}

Why?

• Undocumented APIs aren't in import libraries
• Dynamic resolution makes the tool more portable
• Demonstrates runtime API patching techniques

Step 3: Open Source & Destination Files

HANDLE fileSrc = CreateFile(
    srcfile, 
    GENERIC_READ,          // Source needs read access
    0, NULL, OPEN_EXISTING, 0, NULL
);

HANDLE fileDst = CreateFile(
    dstfile,
    GENERIC_READ | GENERIC_WRITE | FILE_WRITE_ATTRIBUTES,  // Dst needs write
    0, NULL, OPEN_EXISTING, 0, NULL
);

Step 4: Query the Source File's Timestamps

IO_STATUS_BLOCK ioStat;
FILE_BASIC_INFORMATION src_fbi;

pNtQueryInformationFile(
    fileSrc,                          // File handle
    &ioStat,                          // Status block
    &src_fbi,                         // Output buffer
    sizeof(FILE_BASIC_INFORMATION),   // Buffer size
    FileBasicInformation              // Information class
);

Step 5: Copy Timestamps

FILE_BASIC_INFORMATION dst_fbi;

// Get destination file's current metadata
pNtQueryInformationFile(fileDst, &ioStat, &dst_fbi, 
                        sizeof(FILE_BASIC_INFORMATION), FileBasicInformation);

// Replace timestamps
dst_fbi.LastWriteTime = src_fbi.LastWriteTime;
dst_fbi.LastAccessTime = src_fbi.LastAccessTime;
dst_fbi.ChangeTime = src_fbi.ChangeTime;
dst_fbi.CreationTime = src_fbi.CreationTime;

Step 6: Write Modified Metadata Back

pNtSetInformationFile(
    fileDst,                          // File handle
    &ioStat,                          // Status block
    &dst_fbi,                         // Modified structure
    sizeof(FILE_BASIC_INFORMATION),   // Buffer size
    FileBasicInformation              // Information class
);

---

🎬 How It Works (Flow)

┌─────────────────────────────────────────────────┐
│ SOURCE FILE                DESTINATION FILE     │
│ (kernel32.dll)             (malware.exe)        │
└─────────────┬──────────────────────┬────────────┘
              │                      │
              ↓                      ↓
        ┌──────────────┐      ┌──────────────┐
        │ Query        │      │ Query        │
        │ Timestamps   │      │ Timestamps   │
        └──────┬───────┘      └──────┬───────┘
               │                     │
               ↓                     ↓
        ┌──────────────┐      ┌──────────────┐
        │ CreationTime │      │ CreationTime │
        │ LastAccess   │      │ LastAccess   │
        │ LastWrite    │      │ LastWrite    │
        └──────┬───────┘      └──────┬───────┘
               │                     │
               └─────────┬───────────┘
                         ↓
                   COPY TIMESTAMPS
                         ↓
                  ┌──────────────┐
                  │ SetFileInfo  │
                  │ Write Back   │
                  └──────┬───────┘
                         ↓
                    ✅ SUCCESS

---

📊 Real-World Lab Results

I tested this on Windows 10/11. Here's what happens:

Before Timestomping:

C:\> dir /tc test.txt
07/10/2026 10:13 PM

C:\> dir /tw test.txt
07/10/2026 10:15 PM

After timestomping (using kernel32.dll as source):

C:\> dir /tc test.txt
04/30/2026 10:30 PM

C:\> dir /tw test.txt
04/30/2026 10:30 PM

The file now appears to have been created and modified in April—months ago—even though we modified it today.

---

🚨 Why Timestomping Alone Doesn't Work

Here's the critical part: timestomping is easily detected by forensic examiners.

Why Timestamps Can't Be Trusted Alone

1. Creation Time < Last Write Time

   • If a file's creation time is after its last write time, something is wrong
   • Legitimate behavior: Creation ≤ Last Write (always)

2. The NTFS USN Journal

   • NTFS maintains a Change Journal recording all file modifications
   • This journal is harder to modify than file timestamps
   • Forensic examiners cross-reference timestamps with USN entries

3. Event Logs

   • Windows logs application behavior in Event Viewer
   • A process execution is recorded regardless of file timestamps
   • Malware execution can be tied to specific processes

4. Link Files & Prefetch

   • Windows creates .lnk files with accurate timestamps
   • Prefetch files (C:\Windows\Prefetch\) log application execution
   • These are harder to modify than file times

5. MFT Analysis

   • The Master File Table stores multiple timestamp variations
   • Some entries are resistant to modification
   • Examiners compare MFT entries with user-visible timestamps

How Forensic Examiners Detect Timestomping

Timeline:
├── File timestamps: April 30
├── USN Journal: July 10 ✅ MISMATCH
├── Windows Event Log: July 10 ✅ MISMATCH
├── Prefetch: July 10 ✅ MISMATCH
└── MFT Record: July 10 ✅ MISMATCH

CONCLUSION: Timestamps are forged

---

🛡️ Forensic Recommendations

If you're on the defense side, here's how to strengthen your detection:

1. Collect Multiple Data Sources

   ✅ File timestamps
   ✅ USN Journal
   ✅ Windows Event Logs
   ✅ Prefetch files
   ✅ Link files
   ✅ MFT analysis
   ✅ Application logs

1. Monitor File Modifications

   • Use File Integrity Monitoring (FIM) tools
   • Alert on suspicious timestamp changes
   • Correlate with process execution logs

2. Hardening

   • Implement filesystem auditing
   • Enable USN Journal on critical partitions
   • Use WDAC (Windows Defender Application Control) to restrict executable creation
   • Monitor ntdll.dll function calls (suspicious if processes call NtSetInformationFile)

---

🎓 Technical Concepts You'll Learn

By studying this code, you'll understand:

✅ Windows Internals

• NTFS file system structures
• Master File Table (MFT)
• File timestamps and their representations

✅ Native APIs

• How Win32 abstracts the kernel
• Undocumented API usage
• Dynamic API resolution

✅ Forensics & Incident Response

• Timeline reconstruction
• Artifact correlation
• Evidence integrity checks

✅ Malware Analysis

• Common evasion techniques
• Timestamp manipulation detection
• Attribution challenges

---

🔗 Resources & Further Reading

Windows Internals:

• Windows Internals Part 1 & 2
• Undocumented Windows NT API Reference

Forensics:

• SANS: File System Forensics
• EnCase Certification Handbook

NTFS Deep Dive:

• NTFS Documentation - Microsoft Docs
• NTFS $MFT Analysis

Malware Analysis:

• OWASP: Malware Analysis
• VirusTotal Intelligence Blog

---

📦 Full Repository

Check out the complete working code:

GitHub: zainsial866/timestomper

What's included:

• ✅ Complete C source code
• ✅ Detailed README with examples
• ✅ Lab notes documenting behavior
• ✅ Header files with structure definitions
• ✅ Compilation instructions

---

⚖️ Legal & Ethical Note

This tool is for educational purposes and authorized security research only.

Modifying file timestamps without authorization may violate:

• 🛑 Computer Fraud & Abuse Act (CFAA)
• 📜 Evidence tampering laws
• 🔒 Your organization's security policy

Always get explicit authorization before testing on any system.

---

🎯 Conclusion

Timestomping is a powerful technique that demonstrates:

• How easily file metadata can be modified
• Why forensic investigators use multiple data sources
• The importance of understanding Windows internals
• How attackers hide their footprints

But it's also a reminder that no single artifact tells the whole story. Modern incident response requires correlation across logs, events, and file system metadata.

If you're building a SOC, hunting for threats, or just curious about Windows internals—understanding timestomping is critical.

---

Have thoughts on forensics, Windows internals, or cybersecurity? Drop a comment below. 👇

Want to see more deep dives like this? Follow for more technical content on offensive security, Windows research, and malware analysis.

---

About the Author

I'm a cybersecurity student at SS-CASE-IT focusing on offensive security, Windows internals, and tool development. I post technical content on GitHub and maintain a blog covering CTF writeups, security research, and system internals.

Connect with me:

• 🐙 GitHub
• 🔗 LinkedIn

---

Last updated: July 2026