Implications of Timestamp Manipulation for Digital Forensics : Tools, Detection, and Future Directions

Timeline reconstruction is fundamental to digital forensic investigations, as timestamps are critical for establishing the chronological sequence of events. However, several malware and adversaries exploit inherent deficiencies of this procedure by employing timestamp manipulation techniques to conceal malicious activities and mislead forensic examinations. Therefore, research into timestamp forgery is essential. While existing literature focuses on individual tools or detection methods, there is a lack of comprehensive research integrating these perspectives. This study investigates forgery techniques and tools– such as XTST, SetMACE, and Timestomp–incorporating those utilized by prominent threat actors such as APT29 and the Lazarus Group. Furthermore, we classify detection methodologies and evaluate them across four practical scenarios. By analyzing their respective strengths and limitations, this paper provides a strategic roadmap for future research in timestamp forensics.