Take the State of DFIR Survey Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey

Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
Modifying timestamp...
 
Notifications
Clear all

Modifying timestamps of deleted files in the MFT

11 Posts
6 Users
0 Reactions
5,799 Views
neddy
(@neddy)
Estimable Member
Joined: 22 years ago
Posts: 182
 

If this is a theoretical question, the answer is yes. If this relates to an inquiry where someone claims that the date and time stamps have been altered, one has to ask why do this when it would be easier to delete the records entirely. In theory it can be done but as suggested in prior comments it is likely that it could be proven that this was the case and other artefacts need to be considered.



   
ReplyQuote
Page 2 / 2

Enterprise Partners

  • semantics21 2026 FF logo
  • celebrite-logo
  • atola-logo
  • MagnetForensics_ForensicFocus

Partners

  • gmdsoft-logo
  • logo Belkasoft 135x100
  • detego-logo
  • Logo_MSAB_Black (2)
  • Aid4Mail-Logo
  • ADF

Academic Partners

  • University of Southampton logo 2
Share: