AF-011 Reproducibility Dataset: Timestamp Forging via Timestomper (LNK Corroboration)

This dataset contains the primary forensic artifacts for AF-011, a reproducibility case for detecting filesystem timestamp forgery through corroboration between Windows shortcut metadata and NTFS metadata on Windows 10. AF-011 models an anti-forensic scenario in which file timestamps are forged using timestomper.exe. The inconsistency is detected by correlating timestamps preserved in Windows LNK shortcut metadata with corresponding NTFS timestamps in MFT. The expected detection outcome is that AF-011 should fire when LNK target timestamps preserve the original file creation time while the MFT STANDARD_INFORMATION timestamps reflect forged values. Included files in this version are: af011_mft, the raw NTFS Master File Table artifact; af011_mft.csv, the parsed MFT export used to analyze STANDARD_INFORMATION and FILE_NAME timestamps; af011_lnk_properties.csv, the parsed LNK metadata export used to identify target timestamps, target file linkage, and shortcut corroboration evidence; af011_usn_j, the raw NTFS USN change journal artifact; af011_usn_j.csv, the parsed USN export used as supporting filesystem context; and af011_password.docx, the example document associated with the timestomping scenario. Raw NTFS artifacts were extracted from the source image and parsed into CSV using MFTECmd-compatible forensic workflow, while Windows shortcut metadata was extracted and normalized into CSV for reproducible downstream mapping and validation in the IoI framework. Scenario summary: platform Windows 10; manipulation filesystem timestamp forgery using timestomper.exe; expected inconsistency shortcut metadata preserves original target timestamps while MFT $STANDARD_INFORMATION timestamps have been altered. Related framework resources: framework repository https://github.com/ioi-framework/ioi-framework ; case materials https://github.com/ioi-framework/ioi-framework/tree/main/CASES/AF-011 ; website case page https://ioi-framework.github.io/cases/af-011/ This record is intended as a versioned reproducibility dataset for the AF-011 case and may be updated in future Zenodo versions as additional documentation, checksums, manifests, or companion derived files are added.