Wednesday, May 28, 2014

PowerShell - Timestamp Manipulation

PowerShell is more powerful than most people want it to be, but its value to help efficient system administration can not be questioned.  I'm not sure why would anyone needs to use PowerShell to manipulate file time stamps, but I wanted to see its effects.  We talk about timestomp utility that someone might use to manipulate timestamps, but now armed with PowerShell that utility is not needed in skilled hands.  PowerShell is used by network administrators to manage local systems, so seeing the usage of PowerShell will not trigger any potential indicator of "wrong doing".  ( In incident response, press F7 to see the command history, doskey /h will not show PowerShell commands )
 
Get-ChildItem
    Directory: C:\testing
Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---         5/29/2014  12:37 AM          7 test.txt

Thus, entering the following command will add 5 hours to the last write time of every txt file in a directory.  Not just hours, but days, milliseconds, years, months, minutes, or ticks can also be added to file objects.

Get-ChildItem -filter *.txt|foreach { $_.LastWriteTime=($_.LastWriteTime).AddHours(5)}
PS C:\testing> dir
    Directory: C:\testing
Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---         5/29/2014   5:37 AM          7 test.txt

Just as a curiosity, I wanted to see if this additional 5 hours will replicate into all attributes in the MFT record and surprisingly it does not.  The filename attribute retains the original time stamp, so only the standard information attribute is updated by the above PowerShell command.


Good to know. I hope ...











No comments:

Post a Comment