Site hacked but file dates remain unchanged?

Question

So my index.php file was hacked and simply overwritten with a string of text. When I went to look at the files I noticed the date modified remained unchanged. I did not think this was possible?? Any ideas?

Answer 1

PHP's native touch() function's second argument is the timestamp to set the file to. It's trivially faked.