05 · Filesystem & Timestamps
ext4 and XFS Timestamps, Inodes and Deleted Files
How to read MAC and birth timestamps on ext4 and XFS, spot timestomping through ctime, and understand the real limits of deleted file recovery on Linux.
ext4xfstimestamps
Area 05
Filesystem & Timestamps
Filesystem metadata tells you when things happened, if you know how to read it. This area explains inode timestamps and their update rules, recovering birth time on ext4 and XFS, detecting timestomping, and what can and cannot be recovered after deletion.
Key artifacts
- ext4 crtime
- debugfs
- XFS v5
Guides in this area
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- ext4 Timestamps, crtime and Deleted Filesext4 inode timestamps (atime, mtime, ctime, crtime, dtime) with nanoseconds, relatime, the jbd2 journal and what deleted-file recovery can still do.
- XFS Forensics: Inode Timestamps, crtime and Deleted FilesXFS on RHEL-family Linux: v5 inode timestamps with crtime, bigtime, xfs_db inspection, the metadata log, and what remains after a file is deleted.
- /tmp, /var/tmp and /dev/shm: Linux Staging DirectoriesWorld-writable Linux directories attackers use to stage tools: tmpfs versus disk, cleanup ages, noexec, memfd fileless execution and what survives reboot.
- Linux Trash: freedesktop .trashinfo Files and Deleted ItemsThe freedesktop.org Trash on Linux desktops: .trashinfo records with original path and deletion time, the trashed files themselves and per-volume trash folders.
- Linux Thumbnail Cache: ~/.cache/thumbnails ForensicsThe freedesktop thumbnail cache on Linux: PNG previews named by the MD5 of the file URI, holding path and mtime, that outlive deleted files.
- SUID, SGID and File Capabilities: Linux Privilege BackdoorsSUID/SGID bits and file capabilities (security.capability) on Linux: how attackers plant root backdoors and how to baseline them against packages.