A $LogFile Investigation Walkthrough (Fictional Case)
A fictional intrusion on FIN-WKS-07 worked end to end from the NTFS $LogFile: rogue account, toolkit, backdated binary, rclone, a deleted note, and the report.
Posts tagged: #timestomping
Detecting Timestomping with the NTFS $LogFile
How $LogFile exposes timestomping: $STANDARD_INFORMATION before and after values, $SI vs $FN checks, four practical tells, false positives, and how to confirm.