Lion Cipher Lab
Catch a timestomp with NTFS internals: prove a file's real history from $MFT, $UsnJrnl, and $LogFile
- Digital Forensics & IR (DFIR)
- Advanced
- ~90 min
- Free · no account required
Why it matters
Every timeline you build in DFIR rests on timestamps, and timestamps are exactly what a competent intruder edits to cover their tracks — MITRE ATT&CK calls it Timestomp (T1070.006), and it is common enough that trusting file times at face value is how investigations go wrong. The skill that separates an advanced analyst is knowing that NTFS keeps more than one copy of the truth: the $MFT stores two independent timestamp sets, the change journal remembers what happened and when, and the transaction log is a third witness. This lab has you commit the anti-forensic act yourself on a throwaway…
What you'll learn
- reading the $MFT and its attributes ($STANDARD_INFORMATION vs $FILE_NAME)
- detecting timestomping by comparing the two timestamp sets
- analyzing the NTFS $UsnJrnl change journal
- using the $LogFile transaction log as a third witness
- spotting Windows Event Log tampering (Event ID 1102)
- building a defensible file-history timeline that survives anti-forensics
Steps in this lab
- What NTFS actually records about a file
- When you reach for this — and why timestamps lie
- Get the tools, and work only on evidence you own
- Build a disposable NTFS test volume
- Turn on the change journal and record the ground truth
- Commit the anti-forensic act yourself
- Dump the $MFT with MFTECmd
- The tell: $SI disagrees with $FN
- A second $MFT tell: suspiciously clean sub-seconds
- Witness two: the $UsnJrnl change journal
- A built-in cross-check: fsutil file layout
- Witness three: the $LogFile transaction log
- The other half of anti-forensics: clearing the logs
- Read the event logs like an investigator, not a viewer
- Write the finding — the analyst's checklist
- Clean up, and what you actually proved