How to Hide Linux System Activity Traces with Shell Scripts

Overview

File modification timestamps on Linux can be inspected, altered, and restored with standard utilities. A shell script can automate saving the original timestamps and later restoring them, allowing an attacker (or a forensic analyst) to hide or recover evidence.

Step 1: View and modify timestamps

Basic commands:

touch file               # create file or update its mtime to now
touch *                 # update mtime of every file in the current directory
stat file               # display detailed timestamps for a single file
ls -l                   # list detailed information, including timestamps, for many files

Custom timestamps can be set with the -d flag:

touch -d "2001-01-01 20:00:00" file

Step 2: Organize script arguments

The script must handle three mutually exclusive cases based on its first argument:

No argument – print an error message and exit. -s – save the current timestamps to a file. -r – restore timestamps from the saved file.

Conditional logic is implemented with if / else statements.

Step 3: Create the script skeleton

#!/bin/bash
if [ $# -eq 0 ]; then
  echo "Use -s (save) or -r (restore) parameter."
  exit 1
fi

Save the file as timestamps.sh, make it executable ( chmod +x timestamps.sh), and test the no‑argument case.

Step 4: Save timestamps

When the first argument is -s, the script removes any existing timestamps file, then extracts month, day, year and filename for every entry in the current directory. Month names are converted to two‑digit numbers with sed:

rm -f timestamps
ls -l | sed -n \
  's/^.*Jan/01/p; s/^.*Feb/02/p; s/^.*Mar/03/p; s/^.*Apr/04/p; \
   s/^.*May/05/p; s/^.*Jun/06/p; s/^.*Jul/07/p; s/^.*Aug/08/p; \
   s/^.*Sep/09/p; s/^.*Oct/10/p; s/^.*Nov/11/p; s/^.*Dec/12/p' \
  >> timestamps

The resulting timestamps file contains lines such as:

-rw-r--r-- 1 user user 0 01 01 2017 file

Step 5: Restore timestamps

When the first argument is -r, the script reads each line from timestamps, splits it into fields, and rebuilds a date string for touch -d. If the saved year field actually contains a time (e.g., 12:34:56), the script uses the current year; otherwise it uses the saved year.

cat timestamps | while read line; do
  MONTH=$(echo $line | cut -d ' ' -f1)
  DAY=$(echo $line | cut -d ' ' -f2)
  YEAR_OR_TIME=$(echo $line | cut -d ' ' -f3)
  FILENAME=$(echo $line | cut -d ' ' -f4)
  if [[ $YEAR_OR_TIME == *:* ]]; then
    CURRENTYEAR=$(date +%Y)
    touch -d "$CURRENTYEAR-$MONTH-$DAY $YEAR_OR_TIME" "$FILENAME"
  else
    touch -d "$YEAR_OR_TIME-$MONTH-$DAY 00:00:00" "$FILENAME"
  fi
 done

Step 6: Usage workflow

Save timestamps: ./timestamps.sh -s Modify timestamps (example): touch -d "2050-10-12 10:00:00" * Verify changes: ls -a Restore original timestamps: ./timestamps.sh -r Confirm restoration with another ls -a.

Images in the original article illustrate the output of ls -l, the intermediate sed transformation, and the final restored state. They are retained for reference: