Glossary
Timestomping
Altering a file's timestamps to make a malicious file blend in with legitimate ones and mislead investigators.
Timestomping is an anti-forensics technique (MITRE ATT&CK T1070.006) in which an attacker modifies a file's timestamps — usually copying them from a neighbouring legitimate file — so that a recently planted web shell appears to be years old.
Investigators counter it by comparing NTFS $STANDARD_INFORMATION with $FILE_NAME timestamps in the MFT, checking the USN journal for the real creation event, and, on Linux, examining ctime and birth time, which ordinary user tools cannot set. See investigating a web shell.