OpenCyber Academy
Bachelor's · Chapter 26 · English
Course code: OCA-109Chapter 26: OCA-109-C026

Chapter 26 — Digital forensics and malware analysis: methods II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 26 published. Map, example, EX076.

flowchart TD
  N0["Learning outcomes"]
  N1["26.1 MAC times"]
  N2["Lab — file timeline with anomaly flag"]
  N3["26.2 Reading the result"]
  N4["26.3 Interpreting the anomaly"]
  N5["26.4 Timestamp manipulation"]
  N6["26.5 Resolution and zones"]
  N7["26.6 Combining sources"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX076"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["26.1 MAC times"]
  N2["Lab — file timeline with anomaly flag"]
  N3["26.2 Reading the result"]
  N4["26.3 Interpreting the anomaly"]
  N5["26.4 Timestamp manipulation"]
  N6["26.5 Resolution and zones"]
  N7["26.6 Combining sources"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]

[Learning outcomes]
    |
    v
[26.1 MAC times]
    |
    v
[Lab — file timeline with anomaly flag]
    |
    v
[26.2 Reading the result]
    |
    v
[26.3 Interpreting the anomaly]
    |
    v
[26.4 Timestamp manipulation]
    |
    v
[26.5 Resolution and zones]
    |
    v
[26.6 Combining sources]
    |
    v
[Worked example] --> [Exercise EX076]

Learning outcomes

You will (1) build a file-activity timeline from MAC times; (2) detect copy and download patterns; (3) interpret timestamp anomalies cautiously; (4) combine file times with other sources.

26.1 MAC times

File systems record modification, access and creation times (plus metadata change on NTFS). Carrier (2005) describes how each is updated. Applications and copying behave differently: copying or downloading usually sets a new creation time while modification may keep the source's value.

The difference between creation and modification is the key to the lab. A downloaded file is created when it lands on the disk, but its modification time may be set from the source, so modification can be older than creation. A file written by a running process, such as update.dll, typically has both times equal, because it was created and written at once.

Lab — file timeline with anomaly flag

"""File timeline from synthetic MAC times; flag created-after-modified."""
files = {"Q1_budget.xlsm": ("2026-02-10T09:15:10", "2026-01-28T16:02:00"),
         "update.dll":     ("2026-02-10T09:31:05", "2026-02-10T09:31:05"),
         "notes.txt":      ("2026-02-03T11:00:00", "2026-02-09T15:20:00")}
for name, (created, modified) in sorted(files.items(), key=lambda kv: kv[1][0]):
    flag = "created>modified (copied/downloaded?)" if created > modified else ""
    print(f"{created} {name:15} mod={modified} {flag}".rstrip())

Run with python3 lab_mac.py. Verified output:

2026-02-03T11:00:00 notes.txt       mod=2026-02-09T15:20:00
2026-02-10T09:15:10 Q1_budget.xlsm  mod=2026-01-28T16:02:00 created>modified (copied/downloaded?)
2026-02-10T09:31:05 update.dll      mod=2026-02-10T09:31:05

26.2 Reading the result

notes.txt was created on 3 February and modified on 9 February — ordinary editing. Q1_budget.xlsm was created on ws-114 at 09:15:10 on 10 February but carries a modification time of 28 January: created after modified, flagged as consistent with being copied or downloaded. update.dll was created and modified at 09:31:05, consistent with being written fresh by a process.

The lab sorts by creation time, which shows the order in which files appeared on ws-114. The one flagged line is the spreadsheet; notes.txt and update.dll behave as expected. Reading every line, including the ordinary ones, is what makes the flagged line meaningful: it stands out against a background the examiner has checked rather than assumed.

26.3 Interpreting the anomaly

The flag matches the theory that the spreadsheet arrived as an email attachment: its internal modification time came from the sender's system. Alternatives — extraction from an archive, a copy from a USB stick — produce similar patterns, so the timeline is combined with email and browser evidence.

The email evidence decides between them: the phishing message carried an attachment named Q1_budget.xlsm and was delivered at 09:12, three minutes before the file appeared. A USB copy would leave device connection records, which Leah checks and does not find for that morning. The archive explanation would need an archive file in the user's folders, which is also absent.

26.4 Timestamp manipulation

Tools exist that alter timestamps. Inconsistencies between file-system times, internal document metadata and logs can reveal it.

For example, a spreadsheet's internal metadata records when it was last saved by the application. If that time disagrees with the file-system modification time by days without a plausible copy explanation, manipulation is one possibility to consider. Logs from other systems, such as the proxy download time, provide an independent check that the attacker on the endpoint could not easily alter or delete.

26.5 Resolution and zones

NTFS times are stored in UTC with high resolution; FAT stores local time with coarser resolution. Know the file system.

FAT records modification times to two seconds, so a FAT time of 09:31:04 could mean 09:31:04 or 09:31:05. On a USB stick formatted with FAT, times are in whatever local zone the writing computer used, which may differ from the examiner's. NTFS avoids both problems. Leah notes the file system for every timestamp she reports. ws-114's system disk uses NTFS, so the spreadsheet's 09:15:10 is stored in UTC to well under a second.

26.6 Combining sources

The 09:15:10 creation follows the 09:14:30 POST and email delivery at 09:12 — a coherent sequence.

Each step follows within minutes of the previous one, and each comes from a different source: gateway, proxy and file system. A gap of hours, or an event out of order, would prompt a check of clock offsets and timestamp types. Here the sequence is coherent, which supports the phishing explanation and makes the alternatives less likely. Leah still keeps the alternatives in her notes with the evidence that weakened each, so a reviewer can see how the conclusion was reached.

26.7 Presenting

A timeline table: time (UTC), source, artefact, event.

The source column is essential: a reader needs to know that 09:12 came from the email gateway and 09:15:10 from the file system, because their reliability differs. Times are shown in UTC with the offset already applied to ws-114's entries, and a note above the table says so. The table becomes the backbone of the report's narrative, and each row cites its evidence item. Rows from the same source share a colour in the printed version, with the source also named in text for readers who cannot see colour.

Worked example

Leah writes: "Q1_budget.xlsm was created on ws-114 at 09:15:10 UTC with an earlier modification time (28 January), consistent with saving an attachment; the email carrying an attachment of that name was delivered at 09:12."

Synthetic case. Times come from the lab script.

Errors and limits

Access times may be disabled or updated lazily by the OS; rely on them only after checking settings.

Exercises

Synthesis

MAC-time timelines reveal arrival and creation patterns; anomalies need alternatives and corroboration.

Continue studying — chapter 26 of 40

← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →

Worked answers

EX076. Q1_budget.xlsm, because its creation time on ws-114 is later than its modification time, typical of a copied or downloaded file.

EX077. It was extracted from an archive, or copied from a USB drive, both of which can produce the same pattern.

EX078. The operating system may not update them, or may update them only after delays, depending on settings.