NTFS Anti-Forensics Detection and Response — Timestomp / ADS / Journal Wiping
When a timestomping, ADS hiding, or $UsnJrnl/$Prefetch wiping alert is received, secures evidence first, confirms the activity with $SI/$FN inconsistency and journal analysis, and determines the scope.
Prepare
6 steps- Sysmon EID 2/15/23 active
EID 2 (FileCreateTime Changed) captures timestomping, EID 15 (FileCreateStreamHash) ADS creation, and EID 23 (FileDelete) Prefetch deletion signals; SwiftOnSecurity/sysmon-config or olaf/sysmon-config is used as a reference.
- Forwarding to SIEM
Sysmon events must be forwarded to the central SIEM and DR-1 (EID 2 anomaly), DR-2 (suspicious ADS), DR-4 (`fsutil usn deletejournal`), and DR-5 (Prefetch deletion) rules must be active in the production environment.
- EZ toolset ready
MFTECmd, PECmd, AppCompatCacheParser, AmcacheParser, and Timeline Explorer are available on the secure analysis workstation; download source: `https://ericzimmerman.github.io/`
- Collection profiles
Ready triage targets for `$MFT`, `$J`, Prefetch, ShimCache (SYSTEM hive), and Amcache.hve on KAPE or Velociraptor; locked files on live systems are acquired via raw read.
- $UsnJrnl size increased
The default ~32 MB is insufficient; on critical systems it should be increased to ~256 MB with `fsutil usn createjournal m=268435456 a=33554432 C:`.
- Authorization flow defined