Halloween scary PowerShell

Posted On October 31, 2018

Ok, so not sure if it’s all that scary, but interesting what you can do from a security audit stand point. If you Get-Member of a file, you’ll notice something interesting:

You can ‘set’ the ‘Last Access Time’ of a file! That can seem scary, especially if do an audit on someone’s last accessed file times. So yes, you can then back date the time you actually accessed or wrote to a file.

Get-Item C:\temp\text.txt | gm

$File = Get-Item C:\temp\text.txt

$file.LastAccessTime

$file.LastAccessTime = (get-date).AddYears(-200)

 

In fact, you could back date the value by many, many years. I know your next thought might be, is there a limit? Interestingly enough there is, 1601. You can’t set a file create time or last accessed time before 1601 AD. (I wonder how much RAM was available back then?)

And yes, there are many options within the file you could have fun with:

Mike