Build a timeline from sources the attacker did not control

short · 55 min · Objective 4.4

Task

Alter a file's timestamps, then reconstruct the true sequence from corroborating sources -- which is what makes a timeline defensible rather than merely plausible.

Steps

  1. Create a file, note its timestamps, and forward the host's logs to your collector.
  2. Alter the file's timestamps to an earlier date using an ordinary utility, and record both the reported and the true times in lab/timestamps.csv as attribute,reported,true,source.
  3. Reconstruct the true sequence from sources the host's administrator could not alter -- the forwarded logs, the collector's receipt times, a backup catalogue -- and record it in lab/timeline.md.
  4. Check clock synchronisation across every lab host and record the skew in lab/skew.txt. Fix any host that is out.
  5. Write lab/timeline-note.md stating which of your sources are assertions by the compromised host and which are evidence, and why the distinction decides whether a timeline survives challenge.

Verify

awk -F, 'NR>1 && $2!=$3 {n++} END {print n+0" timestamp(s) demonstrably altered"}' lab/timestamps.csv
grep -Ec '[0-9]{2}:[0-9]{2}' lab/timeline.md
grep -Ec . lab/skew.txt
grep -Eci 'assertion|outside|could not alter' lab/timeline-note.md

At least one altered timestamp demonstrated, a timeline with real times, skew measured, and the assertion-versus-evidence distinction written. Metadata under the attacker's control is an assertion; metadata outside it is evidence.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.