Glossary
Timestomping
Deliberately changing a file's timestamps to hide when it was created or modified, typically by rewriting NTFS $STANDARD_INFORMATION times.
Timestomping is the anti-forensic technique of changing file timestamps so a file blends in or drops out of time-based searches (MITRE ATT&CK T1070.006). On NTFS, tools usually call SetFileTime or NtSetInformationFile, which rewrites $STANDARD_INFORMATION; some also manipulate $FILE_NAME indirectly by moving the file afterwards.
Classic tells are $SI created earlier than $FN created and whole-second values where NTFS normally stores 100-nanosecond precision. $LogFile adds the strongest one: the rewrite itself, with the value before and after. Every tell has innocent causes (archive extraction, restores, tunnelling), so findings need corroboration. Method in detecting timestomping with the $LogFile.