Why might an attacker need to use a tool like WinHex after API-based timestamp modification?

Even after using NtSetInformationFile to set all four timestamps, some forensic checks compare values in $STANDARD_INFORMATION and $FILE_NAME MFT locations. WinHex can directly modify these offsets to ensure consistency, eliminating residual evidence of timestamp manipulation. --- **Related reading:** - [Penetration Techniques - Time Attributes of NTFS Files in Windows](/news/penetration-techniques-time-attributes-of-ntfs-files-in-windows) — original article - [Penetration Basics - Implementation of Exchange One-Liner Backdoor](/news/penetration-basics-implementation-of-exchange-one-liner-backdoor) - [Penetration Basics - Methods to Continuously Obtain Exchange User Inbox Emails](/news/penetration-basics-methods-to-continuously-obtain-exchange-user-inbox-emails) - [Steganography Techniques - Hiding Payloads Using JPEG File Format](/news/steganography-techniques-hiding-payloads-using-jpeg-file-format)