Anti-Forensic Techniques

1. Timestomp [ID: T1070.006]

Commands

timedatectl set-time 'yyyy-mm-dd'

Cleanup

# Will set the local/universal time
ntpdate time.nist.gov

# Set the RTC time from system time
hwclock -w

# View the current time
timedatectl

References

• https://www.inversecos.com/2022/08/detecting-linux-anti-forensics.html