Linux Timestamps, Oh boy!

Timestamps are critical for analysts; they usually deal with different filesystems and understanding how the file timestamps work on each is crucial to what they do.

If you do an online search for linux timestamps, you’ll get ton of information but the idea here is to put together different common file operations such as move, copy, download and their effect on timestamps. This can be a helpful guide for anyone who is trying to figure out what might have happened to a file based on timestamp analysis.

Abbreviations used throughout this article:

  • m – modify time
  • a – access time
  • c – change time
  • cr – creation time

For this article, the experiments were performed on a RHEL 6 Ext4 file system.

c time

Change time is the metadata change time. As the name indicates, it reflects the metadata modification of a file (e.g. chown, rename).


Get The Latest DFIR News!

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

cr time

Creation time is one of the most critical timestamps for an analyst. Few points to keep in mind while searching for crtime in linux:

  1. Ext3 filesystem only supports three timestamps – m, a and c.
  2. Ext4 added the support to fourth timestamp that is cr time but the stat utility still shows only three timestamps.
  3. The most common timestomping technique noticed to be used by the attackers is making use of touch command as touch malicious_file -r existing_legit_file. This will create a file malicious_file with the m and a time  same as existing_legit_file. ma times can also be changed individually, for example,  touch -m -d ‘1 Feb 2007 10:31′ malicious_file; touch -a -d ’22 Jan 2008 11:09’ malicious_file.
  4. An analyst can view the crtime on Ext4 filesystem using debugfs, example: sudo debugfs -R “stat /home/user/malicious_file” /dev/vda | grep crtime <The mount point /dev/vda could vary in each case> (Reference 1)

On a side note, don’t confuse the ls -U option in RHEL with the one in OS X that shows the cr time.

In Linux, man ls

“ -U     do not sort; list entries in directory order”

In OS X, man ls

“-U      Use time of file creation, instead of last modification for sorting (-t) or long output (-l).”

a time

Access time appeared to be the most unreliable and unpredictable timestamp. It changes as you expect but once per file per some given time. After that, no matter how many times you perform the same or other operation on the same file that should change it, it doesn’t. A quick research said, access time changes once/day but this has not been tested here. (Reference 2)

Therefore, it is unwise to guess a file’s access operation (such as doing cat or GET on file) by looking at the access time. It was tested on Ubuntu 14.04.1 LTS, Ext4.

File Download – Wget vs Curl

  • Wget

Example: wget http://anysite.com/file

    1. Downloaded file preserved the m time.
    2. Downloaded file’s c time changed to the time when download operation is completed.
  • Curl

Example: curl –remote-name http://anysite.com/file

    1. Downloaded file did NOT preserve the m time.
    2. Downloaded file’s mc changed to the time when download operation is completed.

File Download/Upload – SCP

  • SCP from remote to local (downloading)
    1. Resulting downloaded file’s mac times change to the time when download operation is completed.
    2. The a time of the original file changes to the time when download operation is completed. (Note: same a time change rule applies – therefore it may or may not change)
  • SCP from local to remote (uploading)
    1. Resulting downloaded file’s mac times change to the time when upload operation is completed.
    2. The a time of the original file changes to the time when upload operation is completed. (Note: same a time change rule applies – therefore it may or may not change)

File Copy vs Move

  • Copying a file to a directory
    1. Inherits the ownership from the directory it is copied to.
    2. The file’s mac times change to the time when the file is copied.
    3. The directory’s mc times change to the time when the file is copied.
  • Moving a file to a directory
    1. Does not inherit the ownership from the directory it is copied to
    2. The file’s c time changes to the time when the file is moved.
    3. The directory’s mc times change to the time when the file is moved.

References

  1. http://unix.stackexchange.com/questions/91197/how-to-find-creation-date-of-file
  2. http://unix.stackexchange.com/questions/104207/file-access-time-not-updating-in-ubuntu-12-04

Leave a Comment

Latest Videos

Magnet Forensics' Matt Suiche on the Rise of e-Crime and Info Stealers

Forensic Focus 12th January 2023 3:00 am

Just like your current holiday shopping for last minute presents a lot of the good stuff has gone off the shelves already. You reach to the back and find the toy nobody really wanted but it’s the thought that counts, you stare down at Si and Desi’s Holiday Special 2022 podcast. 

Please join these two as they lament over the year that was, discuss all the things they didn’t do but promise they will do them next year, query whether putting a NAS in the storage of a roller door is a good idea, and finally arrive at what they’re looking forward to bringing you in the new year.

Show Notes:

Arduino PLC IDE - https://docs.arduino.cc/software/plc-ide
Mycroft Mark II (open source Alexa) - https://www.kickstarter.com/projects/aiforeveryone/mycroft-mark-ii-the-open-voice-assistant
Christa’s new blog - https://christammiller.com/
Si’s holiday reading - https://amzn.to/3iJyGrR
Desi’s holiday reading -  https://inteltechniques.com/
Strange event for the end of the year - https://www.reuters.com/world/europe/25-suspected-members-german-far-right-group-arrested-raids-prosecutors-office-2022-12-07/
Si’s wishful thinking - https://www.youtube.com/watch?v=GXnRgXclLd0
Si’s list to do before the EOY - https://intrepidcamera.co.uk/products/intrepid-4x5-camera
Desi’s list to do before EOY - https://www.wired.com/story/how-to-reset-your-phone-before-you-sell-it/
“Cleaning your office” - https://www.manfrotto.com/uk-en/vintage-collapsible-1-5-x-2-1m-ink-sage-ll-lb5720/
Conference recorder - https://amzn.to/3UBmre5
Desi’s blog - https://www.hardlyadequate.com/

Just like your current holiday shopping for last minute presents a lot of the good stuff has gone off the shelves already. You reach to the back and find the toy nobody really wanted but it’s the thought that counts, you stare down at Si and Desi’s Holiday Special 2022 podcast.

Please join these two as they lament over the year that was, discuss all the things they didn’t do but promise they will do them next year, query whether putting a NAS in the storage of a roller door is a good idea, and finally arrive at what they’re looking forward to bringing you in the new year.

Show Notes:

Arduino PLC IDE - https://docs.arduino.cc/software/plc-ide
Mycroft Mark II (open source Alexa) - https://www.kickstarter.com/projects/aiforeveryone/mycroft-mark-ii-the-open-voice-assistant
Christa’s new blog - https://christammiller.com/
Si’s holiday reading - https://amzn.to/3iJyGrR
Desi’s holiday reading - https://inteltechniques.com/
Strange event for the end of the year - https://www.reuters.com/world/europe/25-suspected-members-german-far-right-group-arrested-raids-prosecutors-office-2022-12-07/
Si’s wishful thinking - https://www.youtube.com/watch?v=GXnRgXclLd0
Si’s list to do before the EOY - https://intrepidcamera.co.uk/products/intrepid-4x5-camera
Desi’s list to do before EOY - https://www.wired.com/story/how-to-reset-your-phone-before-you-sell-it/
“Cleaning your office” - https://www.manfrotto.com/uk-en/vintage-collapsible-1-5-x-2-1m-ink-sage-ll-lb5720/
Conference recorder - https://amzn.to/3UBmre5
Desi’s blog - https://www.hardlyadequate.com/

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_BhrBg5_sAKo

Si and Desi Holiday Special 2022

Forensic Focus 16th December 2022 12:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...