Beyond the Touch Command: Correlating Crtime–Mtime Anomalies to Detect Multi-Technique Timestomping on Ext4 File Systems in a Controlled Virtual Environment

Timestomping, or the deliberate alteration of file system timestamps to conceal malicious activity, is still one of the most accessible anti-forensic techniques available to intruders on Linux systems. However, ext4 retains a fourth, less commonly inspected timestamp — crtime — that many single-command tampering methods fail to consistently overwrite. This proposed study investigates whether correlating crtime against the three conventional MACB timestamps, rather than relying on a single timestamp anomaly, can reliably identify files tampered with using multiple distinct timestomping techniques (direct utility manipulation, system clock rollback, and direct inode-level editing) on an ext4-formatted Linux target hosted in an isolated VirtualBox lab environment. A synthetic dataset of tampered and untampered files will be generated using these three techniques, and a set of timestamp-consistency features will be extracted and evaluated first using rule-based heuristics and then with a lightweight supervised classifier. The study’s goal is to create a practical, replicable detection checklist that student and junior incident responders can use with open-source tools alone, as well as to identify which timestamping techniques evade single-timestamp detection logic. Before data collection begins, this proposal presents the study’s rationale, related literature, and planned methodology.

Keywords: digital forensics; anti-forensics; timestomping; ext4 file system; anomaly detection; incident response; ethical hacking.