Meterpreter anti-forensics

In the previous recipe, we read about some of the important and useful Meterpreter file system commands that can be used to perform various tasks on the target machine. Meterpreter contains another interesting command called timestomp. This command is used to change the Modified-Accessed-Created-Entry (MACE) attributes of a file. The attribute value represents the date and time when any of the MACE activities occur within the file. Using the timestomp command, we can change these values.

Getting ready

Before starting with the recipe, you may have a key question. Why change the MACE values? Hackers generally use the technique of changing the MACE values to make the target user think that the file has been...