timestomping using the touch command

0001-01-01

The touch command can be used to timestomp files on Linux systems for anti-forensics purposes. Changing the timestamps on files may be done legitimately in cases of backup restoration, software build pipelines, fixing incorrect timestamps after a system clock issue, and other automation tasks.

To set a specific date on a file:

touch -t YYYYMMDDhhmm.ss /path/to/file

To copy timestamps from another file:

touch -r /path/to/reference_file /path/to/file

No notes link to this note