Let us suppose that a hacker was able to gain root access to a UNIX system. He copied certain files and then changed the system log file to remove information about his access to the system. How could time-stamps analysis help detecting this access
closed as too broad by Ipor Sircer, Jeff Schaller♦, Archemar, countermode, GAD3R Jan 9 '17 at 13:02
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
As the hacker gained root access to the system, they're also able to modify any file timestamp at their will. Therefore any timestamp analysis carried out on the same server must be considered flawed.
As soon as you have an intruder with root access on a machine, all bets are off. You can not trust timestamps.
See also the answers to "How do I deal with a compromised server" at the ServerFault forum (not about timestamps, but about how to act when hacked).
You can check the timestamps of binaries and when the last update was done. Dates on directories could give some hints on when directories were changed.
But this requires some errors, or an attack from a very inexperienced person.
As other have already staten: timestamp can be modified, but usually the kernel could also be "patched", so you cannot trust any data (also checksums of filde) from that computer. Detach hard disk and read from a secure machine. Better: change harddisk and install again the software (possibly secured) and the data from backup.