Timestamps are critical for analysts; they usually deal with different filesystems and understanding how the file timestamps work on each is crucial to what they do.
If you do an online search for linux timestamps, you’ll get ton of information but the idea here is to put together different common file operations such as move, copy, download and their effect on timestamps. This can be a helpful guide for anyone who is trying to figure out what might have happened to a file based on timestamp analysis.
Abbreviations used throughout this article:
- m – modify time
- a – access time
- c – change time
- cr – creation time
For this article, the experiments were performed on a RHEL 6 Ext4 file system.
c time
Change time is the metadata change time. As the name indicates, it reflects the metadata modification of a file (e.g. chown, rename).
cr time
Creation time is one of the most critical timestamps for an analyst. Few points to keep in mind while searching for crtime in linux:
- Ext3 filesystem only supports three timestamps – m, a and c.
- Ext4 added the support to fourth timestamp that is cr time but the stat utility still shows only three timestamps.
- The most common timestomping technique noticed to be used by the attackers is making use of touch command as touch malicious_file -r existing_legit_file. This will create a file malicious_file with the m and a time same as existing_legit_file. ma times can also be changed individually, for example, touch -m -d ‘1 Feb 2007 10:31′ malicious_file; touch -a -d ’22 Jan 2008 11:09’ malicious_file.
- An analyst can view the crtime on Ext4 filesystem using debugfs, example: sudo debugfs -R “stat /home/user/malicious_file” /dev/vda | grep crtime <The mount point /dev/vda could vary in each case> (Reference 1)
On a side note, don’t confuse the ls -U option in RHEL with the one in OS X that shows the cr time.
In Linux, man ls
“ -U do not sort; list entries in directory order”
In OS X, man ls
“-U Use time of file creation, instead of last modification for sorting (-t) or long output (-l).”
a time
Access time appeared to be the most unreliable and unpredictable timestamp. It changes as you expect but once per file per some given time. After that, no matter how many times you perform the same or other operation on the same file that should change it, it doesn’t. A quick research said, access time changes once/day but this has not been tested here. (Reference 2)
Therefore, it is unwise to guess a file’s access operation (such as doing cat or GET on file) by looking at the access time. It was tested on Ubuntu 14.04.1 LTS, Ext4.
File Download – Wget vs Curl
- Wget
Example: wget http://anysite.com/file
- Downloaded file preserved the m time.
- Downloaded file’s c time changed to the time when download operation is completed.
- Curl
Example: curl –remote-name http://anysite.com/file
- Downloaded file did NOT preserve the m time.
- Downloaded file’s mc changed to the time when download operation is completed.
File Download/Upload – SCP
- SCP from remote to local (downloading)
- Resulting downloaded file’s mac times change to the time when download operation is completed.
- The a time of the original file changes to the time when download operation is completed. (Note: same a time change rule applies – therefore it may or may not change)
- SCP from local to remote (uploading)
- Resulting downloaded file’s mac times change to the time when upload operation is completed.
- The a time of the original file changes to the time when upload operation is completed. (Note: same a time change rule applies – therefore it may or may not change)
File Copy vs Move
- Copying a file to a directory
- Inherits the ownership from the directory it is copied to.
- The file’s mac times change to the time when the file is copied.
- The directory’s mc times change to the time when the file is copied.
- Moving a file to a directory
- Does not inherit the ownership from the directory it is copied to
- The file’s c time changes to the time when the file is moved.
- The directory’s mc times change to the time when the file is moved.
References
- http://unix.stackexchange.com/questions/91197/how-to-find-creation-date-of-file
- http://unix.stackexchange.com/questions/104207/file-access-time-not-updating-in-ubuntu-12-04
