Skip to content

Latest commit

 

History

History
191 lines (141 loc) · 6.77 KB

README.md

File metadata and controls

191 lines (141 loc) · 6.77 KB

File Metadata Preservation Scripts for Windows

Windows PowerShell scripts to preserve file modification timestamps while editing.

These scripts help you edit files while maintaining their original "Modified" date in Windows Explorer. This is useful when you need to preserve the appearance of when a file was last modified, even after editing it.

Primary Use Cases

🔴 Red Team Operations & Bait File Creation

These scripts were developed for red teaming and security testing purposes. They enable security professionals to:

  • Create Authentic Bait Files: Generate files that appear to have been created or modified at specific historical dates, making them more convincing for honeypots and deception operations
  • Maintain Operational Security: Edit files during red team exercises without leaving obvious traces of recent modification timestamps
  • Test Security Controls: Evaluate how security tools and analysts respond to files with manipulated timestamps
  • Simulate Historical Artifacts: Create files that blend into existing file systems by matching modification dates of surrounding files

Ethical Use: These scripts are intended for authorized security testing, red team exercises, and legitimate security research only. Unauthorized use to deceive or harm is strictly prohibited.

Supported File Types

The scripts work with any file type:

  • Office documents (.docx, .xlsx, .pptx, etc.)
  • Text files (.txt, .md, .json, etc.)
  • Images, videos, PDFs
  • Any file you can edit with applications

Scripts Overview

PowerShell Scripts

1. preserve_metadata.ps1 - Automated workflow

Monitors file changes and automatically restores timestamp after saving.

2. capture_timestamp.ps1 - Manual workflow step 1

Captures the current timestamp before editing.

3. restore_timestamp.ps1 - Manual workflow step 2

Restores the timestamp after editing.

Usage

Automated workflow (Recommended):

.\preserve_metadata.ps1 yourfile.ext

This script will:

  1. Capture the current modification time
  2. Open the file in your default application
  3. Monitor for changes and automatically restore the timestamp when you save

Manual workflow:

# Step 1: Capture timestamp before editing
.\capture_timestamp.ps1 yourfile.ext

# Step 2: Edit file normally, then save

# Step 3: Restore timestamp after editing
.\restore_timestamp.ps1 yourfile.ext

Using a Reference File:

If you have a backup with the desired timestamp:

.\restore_timestamp.ps1 yourfile.ext reference_file.ext

Setup

  1. PowerShell Execution Policy: You may need to allow script execution:

    Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

  2. The scripts use Windows PowerShell cmdlets:

    • Get-Item - Get file information
    • (Get-Item).LastWriteTime - Get/set modification time
    • (Get-Item).Length - Get file size
    • Start-Process - Open file in default application

How It Works

The scripts use Windows PowerShell to:

  1. Capture the original file modification time using Get-Item and LastWriteTime
  2. Allow normal editing - file content updates normally
  3. Restore the original filesystem timestamp by setting LastWriteTime property

Red Team Considerations

When using these scripts for red team operations:

  • Forensic Detection: Advanced forensic tools may detect timestamp manipulation through:

    • NTFS MFT (Master File Table) analysis
    • MAC (Modified, Accessed, Created) time inconsistencies
    • Application-level metadata (e.g., Office document properties)
    • File content hash changes without timestamp updates
    • Windows Event Logs (if auditing is enabled)

  • Best Practices:

    • Use reference files from the target environment when possible
    • Test timestamp restoration on similar systems before operations
    • Consider application-specific metadata that may reveal manipulation
    • Document timestamp changes for post-operation analysis
    • Be aware that NTFS stores multiple timestamps (Created, Modified, Accessed)

Limitations

  • File Content Changes: File content updates normally - only filesystem timestamp is preserved
  • File Permissions: Scripts need read/write access to files
  • Monitoring Accuracy: Automated script monitors file size changes
  • Application Internal Metadata: Some applications maintain internal metadata that cannot be preserved while saving changes
  • Forensic Detection: These scripts only modify filesystem timestamps. Advanced forensic analysis may still detect manipulation
  • NTFS Timestamps: Windows maintains Created, Modified, and Accessed times. These scripts primarily modify the Modified time
  • PowerShell Version: Requires PowerShell 5.1 or later (included in Windows 10/11)

Troubleshooting

"Execution Policy" error

Run: Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

"Permission denied"

Ensure you have write permissions to the file and directory. Right-click PowerShell and select "Run as Administrator" if needed.

Timestamp not restored

Check file permissions and ensure no other processes are accessing the file. Some applications may lock files.

File doesn't open

The Start-Process command may not work in all environments. Open files manually if needed.

Script won't run

Ensure you're running PowerShell (not Command Prompt) and the execution policy allows scripts.

Examples

Red Team: Create bait file matching existing file timestamp:

# Capture timestamp from a legitimate file in the target directory
.\capture_timestamp.ps1 C:\Users\Target\Documents\legitimate_document.docx

# Create/edit your bait file, then restore using the captured timestamp
.\restore_timestamp.ps1 bait_file.docx C:\Users\Target\Documents\legitimate_document.docx

Preserve Excel file timestamp:

.\preserve_metadata.ps1 report.xlsx
# Edit in Excel, save, timestamp automatically restored

Preserve document timestamp:

.\capture_timestamp.ps1 thesis.docx
# Edit document...
.\restore_timestamp.ps1 thesis.docx

Batch processing:

Get-ChildItem -Filter *.pdf | ForEach-Object {
    .\capture_timestamp.ps1 $_.FullName
    # Edit files...
    .\restore_timestamp.ps1 $_.FullName
}

Advanced Usage

Check current timestamp:

(Get-Item yourfile.ext).LastWriteTime

Set specific timestamp:

$file = Get-Item yourfile.ext
$file.LastWriteTime = Get-Date "2024-01-15 10:30:00"

View all timestamps:

$file = Get-Item yourfile.ext
Write-Host "Created: $($file.CreationTime)"
Write-Host "Modified: $($file.LastWriteTime)"
Write-Host "Accessed: $($file.LastAccessTime)"

License

These scripts are provided as-is for educational and practical use.