Where does LinkDate come from?

From the binary's PE header, IMAGE_FILE_HEADER.TimeDateStamp. The linker writes it. Amcache reads it at inventory time and stores it as a string.

Can attackers control it?

Completely. Set to anything, zeroed for reproducible builds, deliberately backdated. One of the most attacker-controllable timestamps in Windows DFIR.

Can I use LinkDate as 'when the file appeared on the host'?

No. That is KeyLastWriteTimestamp, and even that is only an upper bound. LinkDate has nothing to do with the host.

What is LinkDate good for?

Clustering binaries by build campaign. Sort suspicious binaries by LinkDate and look for tight clusters within hours of each other. Attackers compile their toolkit in one sitting and the link times cluster. Also useful for BYOVD: old LinkDate plus recent KeyLastWriteTimestamp is the classic shape.

Is LinkDate ever zero?

Yes. Reproducible builds and some Go binaries zero it deliberately. Zero is not suspicious on its own, but it does mean the field gives you nothing.

What is LinkDate in Amcache? (glossary)

LinkDate is the PE TimeDateStamp. The linker writes it into the binary at build time. Amcache reads it back from the PE header at inventory time. That is the whole story.

It is not a host-side timestamp. The host has nothing to do with this value. It travels with the binary. An attacker can set it to whatever they want, leave it at zero, or pick a date in 2007 to make the file look like an old, established piece of software. Plenty do.

The contrast with KeyLastWriteTimestamp#

	KeyLastWriteTimestamp	LinkDate
Source	Registry metadata, written by appraiser	PE header, written by linker
Attacker controls it?	No	Yes
Answers	When did Amcache record this?	When was the binary built?
Good for	Host-side first-seen approximations	Build-campaign clustering
Resolution	Seconds	Seconds

Confusing these two is the single most common Amcache mistake. The fix is to never, ever, use LinkDate to argue about when a binary appeared on a host. See Amcache timestamps explained for the long-form version.

What it is actually good for#

Build clustering#

Sort unsigned PEs by LinkDate. Look for 3-10 binaries stamped within the same day or hour. That is one attacker compiling their kit in one sitting and dropping it across one or more hosts. Strong campaign signal.

Import-Csv .\HOST_amcache_UnassociatedFileEntries.csv |
  Where-Object { $_.IsPeFile -eq 'True' -and -not $_.Publisher } |
  Sort-Object LinkDate |
  Select LinkDate, Hash, FullPath

BYOVD detection#

Drivers in DriverBinaries.csv with DriverTimeStamp from years ago but KeyLastWriteTimestamp from this week are the classic BYOVD shape. See the BYOVD glossary.

Build-process drift#

"Our CI builds always linkstamp Mondays at 03:00. This one is Tuesday at 14:00." Useful for catching when an internal build pipeline got nudged or compromised.

What it is not good for#

First-seen-on-host time. Use KeyLastWriteTimestamp.
Order of arrival. Two binaries with the same LinkDate can have arrived months apart.
Cryptographic identity. Many unrelated binaries share LinkDate values, especially zero.