In more detail
Timestomping is deliberately altering a file's timestamps, usually the created, modified and accessed times, to make malicious files blend in with older legitimate ones or to disrupt a timeline. Tools can set any value through the normal API. Investigators look for clues such as a file modified before it was created, timestamps rounded to whole seconds, or on NTFS a mismatch between the two sets of timestamps the file system keeps: those in $STANDARD_INFORMATION, which programs can set, and those in $FILE_NAME, which normally only the system updates. Cross-checking with logs and other artefacts helps reveal the real timeline. See also Unix timestamp.
Why it matters
Timelines drive an investigation. If an intruder's tool looks like it was installed years ago, analysts may exclude it from the incident window and miss the compromise. Timestomping is a recognised technique for hiding attacker activity, and finding it is itself an Indicator of compromise (IOC). Not every anomaly is malicious, though: copying and moving files legitimately changes some timestamps.
Example
An executable shows $STANDARD_INFORMATION created 2019-04-17 18:40:00.0000000 (FILETIME 132000000000000000, 100-nanosecond ticks since 1601) but $FILE_NAME created 2026-03-14 09:26:53.5834120 (134179540135834120). A file cannot be 2,523 days older than its own name record, and the clean .0000000 fraction is typical of a tool that supplied whole seconds. Combined with a prefetch or event-log entry from 2026, that is strong evidence of tampering. The registry and log tools help build the cross-check.