Timestomping, the name for what you are describing, is easy to do and easy to detect. There are lots of advanced techniques to manipulate various aspects of Ti

Timestomping, the name for what you are describing, is easy to do and easy to detect. There are lots of advanced techniques to manipulate various aspects of Time related artifacts, but there are also lots of advanced techniques for determining whether a system has been tampered with. A skilled person might be able to erase evidence of exactly what they did, but often this creates artifacts or even an absence of artifacts that can be used to determine that someone tampered with the system in an attempt to cover his tracks. I specialize in forensics in the context of incident response, so I don't typically run into anti-forensic techniques as sophisticated as law enforcement analysts may encounter. Perhaps there are ways to completely avoid detection. However, I imagine it would be difficult.