How can I check whether file modified time has been spoofed on ext4?

Question

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem.

How would I discover if files have been changed, but the modified times have been made to look like the files have not been tampered with?

I'm most interested in a way to check whether this has already happened, rather than using a tool which checks whether it happens from now on.

See superuser.com/questions/387042/… and unix.com/tips-and-tutorials/20526-mtime-ctime-atime.html — Neil Smithline, Dec 9 '15 at 19:53
I'm voting to close this question as off-topic, and not about infosec. An alternative would be to move it to superuser.com, but they'll likely close it as a dup of the above question. — Neil Smithline, Dec 9 '15 at 19:54
@NeilSmithline thanks for looking up some links, but I already know about the various timestamps in Unix and Linux. I'm more interested in how you would know if files had been changed, if an attacker tried to cover it up. Would that not fall under infosec? — Arronical, Dec 10 '15 at 9:20
It's a close call and others may disagree. If the answer involved IDs then it's infosec. But the answer is OS specific calls so it belongs there, IMO. — Neil Smithline, Dec 10 '15 at 15:00
If the ctime is newer than the atime or mtime then the file timestamps have been tampered with. Isn't that what you want? Note that there is no defense against a temporary clock reset. — Neil Smithline, Dec 10 '15 at 15:03

Romain Clair · Accepted Answer · 2015-12-09 15:11:56Z

2

Host Intrusion Detection Systems (HIDS) can offer this feature : File integrity checking.

I don't try it personnaly but according to the documentation AIDE can do this.

The idea is to create hash values of the files you want to verify they don't change then compare them regularly with new calculated values.

answered Dec 9 '15 at 15:11

Romain Clair

5302 silver badges10 bronze badges

Sounds like a good start, but I assume this has to be set up before I think that an intrusion has happened? – Arronical Dec 9 '15 at 15:20
Yep. If you think it already happened and it's possible that the modified date was also changed, i think your system is heavily compromised and you should consider get your backups to recover from it. – Romain Clair Dec 9 '15 at 15:23
Fortunately this is a hypothetical situation. Just interested in data forensics and keen to know if there are any ways to check this retroactively. – Arronical Dec 9 '15 at 15:26
1

No - there is no retrospective way to do this, you need a system set up to monitor intrusion, otherwise an attacker can change anything on the system – Rory Alsop♦ Dec 10 '15 at 14:55
1

@RoryAlsop There are retrospective ways to do this. Anomalies in the mtime and hidden crtime (not ctime) can give away whether a file was modified, but it's context dependent. You can also check the inode number and see if it makes sense (if the mtime implies the last modification was ages ago, yet the inode number is big enough that it must have been created recently, you know something is going on). – forest Nov 2 '18 at 2:35

| show 1 more comment

1 Answer 1