How can I check whether file modified time has been spoofed on ext4?

Question

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem.

How would I discover if files have been changed, but the modified times have been made to look like the files have not been tampered with?

I'm most interested in a way to check whether this has already happened, rather than using a tool which checks whether it happens from now on.

See superuser.com/questions/387042/… and unix.com/tips-and-tutorials/20526-mtime-ctime-atime.html — Neil Smithline, Dec 9, 2015 at 19:53
I'm voting to close this question as off-topic, and not about infosec. An alternative would be to move it to superuser.com, but they'll likely close it as a dup of the above question. — Neil Smithline, Dec 9, 2015 at 19:54
@NeilSmithline thanks for looking up some links, but I already know about the various timestamps in Unix and Linux. I'm more interested in how you would know if files had been changed, if an attacker tried to cover it up. Would that not fall under infosec? — Arronical, Dec 10, 2015 at 9:20
It's a close call and others may disagree. If the answer involved IDs then it's infosec. But the answer is OS specific calls so it belongs there, IMO. — Neil Smithline, Dec 10, 2015 at 15:00
If the ctime is newer than the atime or mtime then the file timestamps have been tampered with. Isn't that what you want? Note that there is no defense against a temporary clock reset. — Neil Smithline, Dec 10, 2015 at 15:03

Romain Clair · Accepted Answer · 2015-12-09 15:11:56Z

2

Host Intrusion Detection Systems (HIDS) can offer this feature : File integrity checking.

I don't try it personnaly but according to the documentation AIDE can do this.

The idea is to create hash values of the files you want to verify they don't change then compare them regularly with new calculated values.

answered Dec 9, 2015 at 15:11

Romain Clair

5502 silver badges10 bronze badges

Sounds like a good start, but I assume this has to be set up before I think that an intrusion has happened?
– Arronical
Dec 9, 2015 at 15:20
Yep. If you think it already happened and it's possible that the modified date was also changed, i think your system is heavily compromised and you should consider get your backups to recover from it.
– Romain Clair
Dec 9, 2015 at 15:23
Fortunately this is a hypothetical situation. Just interested in data forensics and keen to know if there are any ways to check this retroactively.
– Arronical
Dec 9, 2015 at 15:26
1

No - there is no retrospective way to do this, you need a system set up to monitor intrusion, otherwise an attacker can change anything on the system
– Rory Alsop ♦
Dec 10, 2015 at 14:55
1

@RoryAlsop There are retrospective ways to do this. Anomalies in the mtime and hidden crtime (not ctime) can give away whether a file was modified, but it's context dependent. You can also check the inode number and see if it makes sense (if the mtime implies the last modification was ages ago, yet the inode number is big enough that it must have been created recently, you know something is going on).
– forest
Nov 2, 2018 at 2:35

| Show 1 more comment

1 Answer 1