The touch Command Trick Attackers Use to Fake File Timestamps

touch Command Complete Tutorial: Why SOC Analysts Care About a "Boring" Linux Command

Quick Answer: touch creates empty files and updates timestamps — but attackers use the same syntax to forge file times and hide their tracks. Knowing both sides makes you faster at incident response.

Last verified: September 2026

Picture this: you're reviewing a compromised web server after a client reported "weird files" in their upload directory. You run ls -la on the suspicious folder, and every single file — the webshell included — shows the exact same creation and modification timestamp as the legitimate files around it. Down to the second. That's not a coincidence. That's touch being used against you.

Most tutorials treat touch as a beginner command you learn in your first week of Linux and forget about. In a SOC, it's the opposite — touch shows up constantly in timeline analysis, log forensics, and yes, in attacker anti-forensic tricks. This guide covers the full command, then walks through exactly how and why it matters during an investigation.

Table of Contents

• The Basics: Creating Files
• Timestamp Control (Where It Gets Interesting)
• Bulk Creation and Patterns
• The Forensic Angle: Timestomping
• Detection & Prevention
• Expert Tips
• FAQ

The Basics: Creating Files

At its core, touch does one of two things: create a new empty file, or update the timestamps on an existing one. That simplicity is exactly why it's everywhere — in build scripts, deployment pipelines, and cron jobs — and exactly why its misuse is so easy to overlook.

touch file.txt

Creates a new empty file named file.txt in the current directory. If the file already exists, this only updates its access and modification timestamps — it does not erase existing content.

touch file1.txt file2.txt file3.txt

Creates multiple empty files in one call. Useful when scaffolding a project structure or prepping placeholder log files for a test environment.

touch file.txt script.sh config.conf

Same idea, across different extensions. Handy when you need to quickly stub out a set of config or script files before populating them.

touch /tmp/new.txt

Creates the file in a specific path rather than the current working directory. In incident response, you'll often see attackers drop files into world-writable paths like /tmp or /dev/shm precisely because they're easy to write to and easy to overlook.

touch -c file.txt

The -c flag ("no-create") updates the timestamp only if the file already exists — it will not create a new file if the target is missing. This is the safer option to use in scripts where you don't want to accidentally create stray files.

Timestamp Control (Where It Gets Interesting)

This is the part of touch that most tutorials skip past — and the part that matters most for security work.

touch -t 202504071200 file.txt

Sets the file's timestamp to a specific date and time — here, April 7, 2025 at 12:00. The format is [[CC]YY]MMDDhhmm[.ss]. Notice something: this lets anyone set a file's recorded modification time to any date they want, past or future. Keep that in mind for the forensics section below.

touch -r reference.txt file.txt

Copies the timestamp from reference.txt onto file.txt. This is the classic "blend in" move — an attacker drops a malicious file, then matches its timestamp to a legitimate system file sitting in the same directory so it doesn't stand out in a sorted ls -la listing.

touch -a file.txt

Updates only the access time (atime), leaving modification time (mtime) untouched.

touch -m file.txt

Updates only the modification time (mtime), leaving access time (atime) untouched.

touch -am file.txt

Updates both access and modification timestamps to the current time.

Why does splitting atime and mtime matter? Because some quick, sloppy anti-forensic attempts only think to fix one timestamp. An experienced analyst checks both atime and mtime — and, critically, ctime (change time, which records metadata changes and generally can't be forged with touch alone) — because a mismatch between them is often the tell.

Bulk Creation and Patterns

touch .hidden

Creates a hidden file (any filename starting with a dot is hidden from a default ls listing, though never from ls -a). Dotfiles are a common — and honestly overused — hiding spot for persistence scripts and staged payload files.

touch "my file.txt"

Quoting handles filenames containing spaces.

touch log{1..5}.txt

Bash brace expansion creates log1.txt through log5.txt in one shot.

touch {a,b,c}.txt

Creates a.txt, b.txt, and c.txt — useful for quickly scaffolding test fixtures.

touch file.{txt,log,conf}

Creates file.txt, file.log, and file.conf — same base name, multiple extensions.

find . -name "*.log" -exec touch {} +

Updates the timestamp of every .log file found under the current directory. Legitimately, this is used to force log rotation tools or monitoring agents to re-read files. In a compromised environment, a broad find ... -exec touch sweep across a directory tree is also a known technique to mass-normalize timestamps after planting multiple files — so treat a burst of identical timestamps across many files as a signal worth checking, not just routine maintenance.

find . -type f -mtime +30 -exec touch {} +

Updates files that haven't been modified in more than 30 days. Use with caution — this permanently overwrites the original modification time, which destroys evidence of when a file was actually last touched. Never run this against a directory that might later need forensic review.

touch "backup_$(date +%F).txt"

Embeds the current date into the filename using command substitution — a common pattern in backup and log-rotation scripts.

touch file.txt && ls -l file.txt

Creates the file, then immediately confirms it with a directory listing — a quick verification habit worth building into scripts.

[ -d /tmp ] && touch /tmp/test.txt

Only creates the file if /tmp exists as a directory, avoiding errors in scripts that run across inconsistent environments.

The Forensic Angle: Timestomping

The technique of using touch (or equivalent tools) to alter file timestamps and mislead investigators has a name in the security community: timestomping. MITRE ATT&CK catalogs it under technique T1070.006, filed under defense evasion. The logic is simple and effective: if a SOC analyst is sorting files by modification date to build a timeline of "what changed around the time of the breach," an attacker who backdates their malicious file to blend in with legitimate, older files can slip past a timeline-based review entirely.

This isn't theoretical — timestomping shows up repeatedly in real intrusion reports involving both commodity malware and more deliberate, hands-on-keyboard attackers who take time to cover their tracks after establishing persistence.

Detection & Prevention

Because touch -t and touch -r can rewrite atime and mtime freely, you cannot rely on ls -la alone during an investigation. A few practical checks that hold up better:

• Compare mtime against ctime. Standard touch can't forge ctime (inode change time) on most filesystems — a file with a suspiciously old mtime but a recent ctime is a strong timestomping indicator. Check with stat filename, which shows Access, Modify, and Change times separately.
• Cross-reference filesystem journal or auditd logs. If auditd is watching the directory (auditctl -w /path -p wa), file writes get logged independently of what the file's own metadata claims.
• Check EXIF/embedded timestamps in file content where applicable — some file formats carry internal creation dates that don't get touched by filesystem-level timestamp edits.
• Watch for clustering. A dozen files in one directory sharing an identical, second-precise timestamp is far more consistent with a scripted touch -r pass than with organic, independent file writes.
• Lock down destructive bulk operations. Never run find ... -mtime +N -exec touch {} + against directories that may need future forensic review — restrict it to genuinely disposable maintenance paths.

According to general guidance from digital forensics practitioners, no single timestamp check is conclusive on its own — the goal is corroboration across multiple independent sources (filesystem metadata, journal logs, application logs, and where possible, network telemetry) rather than trusting any one signal in isolation.

Expert Tips

• Use stat filename instead of ls -la whenever timestamp integrity actually matters — it shows all three timestamps plus the inode number.
• In scripts, prefer touch -c over plain touch to avoid silently creating unintended files on typos or missing paths.
• If you're building detection rules, alert on touch combined with -t or -r flags in EDR process telemetry within directories like /var/www, /tmp, or application upload folders — legitimate admin use of those flags in those paths is rare.
• Remember that timestomping only affects filesystem metadata — it does nothing to hide the fact that a file's content is malicious. Static and behavioral analysis of the file itself still applies.

Related Articles

• more vs less Linux Commands: The SOC Analyst's Log Review Guide
• tail -f Explained: The Linux Command That Beats Your SIEM's Delay

FAQ

Does touch modify a file's content?

No. If the file already exists, touch only updates its timestamps — it never alters or truncates the file's contents.

Can touch create a file with content already in it?

No, touch always creates empty (zero-byte) files. To create a file with content, use redirection like echo "text" > file.txt or an editor.

What's the difference between atime, mtime, and ctime?

Atime is the last access (read) time, mtime is the last content modification time, and ctime is the last metadata change time (permissions, ownership, or the file being renamed/moved). Standard touch can set atime and mtime directly but cannot forge ctime.

Is timestomping illegal?

Using touch itself is not illegal — it's a standard, everyday utility. Using it specifically to obstruct an investigation or conceal unauthorized access is the malicious act, not the command.

Can touch bypass file permissions?

No. You need write permission on the directory (to create a file) or on the file itself (to update its timestamp) — touch respects standard Linux permission checks like any other command.

How do I check the actual creation time of a file on Linux?

Traditional ext4/most Linux filesystems don't universally expose a true "birth time" the way stat does on newer filesystems like Btrfs or XFS with crtime support. Run stat filename and check if a "Birth" field is present.

Conclusion

The touch command is one of the simplest tools in Linux — and one of the easiest to underestimate. For day-to-day work, it's a convenience command for scaffolding files and forcing timestamp updates. For a SOC analyst doing timeline reconstruction, it's a reminder that filesystem metadata is not ground truth by default — it's a claim, and claims need corroboration. The next time a compromised host's file timestamps look a little too clean, you'll know exactly what to check next.

Analysis based on SOC monitoring and public threat intelligence review.