hard20 pts · first answer countsdigital-forensics

Detecting timestomping

A malware file shows a creation time from 2019, but you suspect it arrived last week. Which NTFS evidence best reveals timestamp tampering?

A.The file's size in bytesB.Comparing $STANDARD_INFORMATION times with $FILE_NAME times in the MFT, since common tools change only $STANDARD_INFORMATIONC.The file extensionD.The Recycle Bin contents

Discussion 0

Join free to post in the discussion.

Detecting timestomping

Discussion 0

Related questions