How to check all ti...
 
Notifications
Clear all

How to check all timestamps of file  

Page 1 / 2
gorvq7222
(@gorvq7222)
Active Member

A friend of mine she asked me how to check all timestamps of a file on an NTFS volume. She did not have EnCase or FTK in hand. So I gave her FTK Imager and showed her the creation time, access time and modified time of a file. All she need to do is to take a look at properties of file.

You guys could take a look at my blog to see the screenshots.
http//www.cnblogs.com/pieces0310/p/6280086.html

Second I showed her another option - Winhex. Check Options->Directory Browser to make sure all four timestamps will show up in file lists. Now she could see all four timestamps in local time format in file lists.

Quote
Topic starter Posted : 12/01/2017 7:44 pm
jaclaz
(@jaclaz)
Community Legend

The four timestamps that are actually eight? ?

http//reboot.pro/topic/15960-setmace/
http//reboot.pro/files/file/216-ntfs-tools-collection/

On github
https://github.com/jschicht?tab=repositories

Particularly
https://github.com/jschicht/MftRcrd

See
http//superuser.com/questions/973547/how-can-i-display-all-8-ntfs-timestamps

jaclaz

ReplyQuote
Posted : 12/01/2017 10:09 pm
keydet89
(@keydet89)
Community Legend

Between the $STANDARD_INFORMATION and $FILE_NAME attributes, I've seen a total of 12 (and in some cases, 16) time stamps. I use a Perl script to parse through and display these values. The Perl script can be 'compiled' into a standalone .exe file for Windows systems.

ReplyQuote
Posted : 12/01/2017 11:06 pm
thefuf
(@thefuf)
Active Member

I have seen 9 timestamps D

ReplyQuote
Posted : 13/01/2017 12:10 am
jaclaz
(@jaclaz)
Community Legend

I think we can agree on "double or more" than the original 4. wink

The actual number should be 4+4 or 4+8 for a "normal" file, depending on filename length, as explained by Joakim on the given links.

jaclaz

ReplyQuote
Posted : 13/01/2017 12:54 am
thefuf
(@thefuf)
Active Member

I think we can agree on "double or more" than the original 4. wink

The actual number should be 4+4 or 4+8 for a "normal" file, depending on filename length, as explained by Joakim on the given links.

jaclaz

Don't forget about hard links and Object IDs.

ReplyQuote
Posted : 13/01/2017 1:10 am
jaclaz
(@jaclaz)
Community Legend

Don't forget about hard links and Object IDs.

Sure ) , that's why I expressly specified "normal" files. roll

But we could go for "at least eight" wink .

jaclaz

ReplyQuote
Posted : 13/01/2017 1:34 am
thefuf
(@thefuf)
Active Member

Don't forget about hard links and Object IDs.

Sure ) , that's why I expressly specified "normal" files. roll

But we could go for "at least eight" wink .

jaclaz

"Normal" files on internal drives are expected to have Object IDs )

ReplyQuote
Posted : 13/01/2017 2:29 am
jaclaz
(@jaclaz)
Community Legend

"Normal" files on internal drives are expected to have Object IDs )

But strictly speaking an Object ID is not a timestamp, it is a GUID.
https://0cch.com/ntfsdoc/attributes/object_id.html

And it seems like there are cases where no Obiect_ID is associated to files
https://digital-forensics.sans.org/blog/2009/12/24/ntfs-attributes-part-one

jaclaz

ReplyQuote
Posted : 13/01/2017 2:58 pm
thefuf
(@thefuf)
Active Member

"Normal" files on internal drives are expected to have Object IDs )

But strictly speaking an Object ID is not a timestamp, it is a GUID.
https://0cch.com/ntfsdoc/attributes/object_id.html

And it seems like there are cases where no Obiect_ID is associated to files
https://digital-forensics.sans.org/blog/2009/12/24/ntfs-attributes-part-one

jaclaz

But this GUID includes a timestamp.

ReplyQuote
Posted : 13/01/2017 4:02 pm
jaclaz
(@jaclaz)
Community Legend

But this GUID includes a timestamp.

Maybe, or maybe not.
http//blog.stephencleary.com/2010/11/few-words-on-guids.html

jaclaz

ReplyQuote
Posted : 13/01/2017 6:18 pm
thefuf
(@thefuf)
Active Member

But this GUID includes a timestamp.

Maybe, or maybe not.
http//blog.stephencleary.com/2010/11/few-words-on-guids.html

jaclaz

This link has nothing to do with the NTFS driver and the kernel. Version 1 GUIDs are generated even in Windows 10.

ReplyQuote
Posted : 13/01/2017 7:16 pm
jaclaz
(@jaclaz)
Community Legend

This link has nothing to do with the NTFS driver and the kernel. Version 1 GUIDs are generated even in Windows 10.

Good to know. )

Do you have a decoder handy?

Just created a new volume in XP (IMDISK), formatted it NTFS and made a test.txt file in it, then MFTRCRD
MFTRCRD N\test.txt -d indxdump=off 1024 -s

$STANDARD_INFORMATION 1
File Create Time (CTime) 2017-01-13 1853586205000
File Modified Time (ATime) 2017-01-13 1854196361250
MFT Entry modified Time (MTime) 2017-01-13 1854281361250
File Last Access Time (RTime) 2017-01-13 1854237767500

$FILE_NAME 1
Parent MFTReference 5
ParentSequenceNo 5
File Create Time (CTime) 2017-01-13 1853586205000
File Modified Time (ATime) 2017-01-13 1854196361250
MFT Entry modified Time (MTime) 2017-01-13 1854196361250
File Last Access Time (RTime) 2017-01-13 1854196361250

$OBJECT_ID 1
GUID Object Id {37D54FD4-D1EB-11E6-B0C6-001FC6BB76CE}

Can you check this one?
37D54FD4-D1EB-11E6-B0C6-001FC6BB76CE

The online thingy
https://www.famkruithof.net/uuid/uuidgen

gets

The UUID 37D54FD4-D1EB-11E6-B0C6-001FC6BB76CE contains a timestamp taken at
Tuesday, January 3, 2017 73126 PM GMT

that makes little sense.

Maybe there is an issue in MFTRCRD or in the online decoder (or in both). 😯

jaclaz

P.S. Tested in another decoder, same result
http//www.mahonri.info/cgi/uuid.cgi

ReplyQuote
Posted : 14/01/2017 12:02 am
thefuf
(@thefuf)
Active Member

This link has nothing to do with the NTFS driver and the kernel. Version 1 GUIDs are generated even in Windows 10.

Good to know. )

Do you have a decoder handy?

Just created a new volume in XP (IMDISK), formatted it NTFS and made a test.txt file in it, then MFTRCRD
MFTRCRD N\test.txt -d indxdump=off 1024 -s

$STANDARD_INFORMATION 1
File Create Time (CTime) 2017-01-13 1853586205000
File Modified Time (ATime) 2017-01-13 1854196361250
MFT Entry modified Time (MTime) 2017-01-13 1854281361250
File Last Access Time (RTime) 2017-01-13 1854237767500

$FILE_NAME 1
Parent MFTReference 5
ParentSequenceNo 5
File Create Time (CTime) 2017-01-13 1853586205000
File Modified Time (ATime) 2017-01-13 1854196361250
MFT Entry modified Time (MTime) 2017-01-13 1854196361250
File Last Access Time (RTime) 2017-01-13 1854196361250

$OBJECT_ID 1
GUID Object Id {37D54FD4-D1EB-11E6-B0C6-001FC6BB76CE}

Can you check this one?
37D54FD4-D1EB-11E6-B0C6-001FC6BB76CE

The online thingy
https://www.famkruithof.net/uuid/uuidgen

gets

The UUID 37D54FD4-D1EB-11E6-B0C6-001FC6BB76CE contains a timestamp taken at
Tuesday, January 3, 2017 73126 PM GMT

that makes little sense.

Maybe there is an issue in MFTRCRD or in the online decoder (or in both). 😯

jaclaz

P.S. Tested in another decoder, same result
http//www.mahonri.info/cgi/uuid.cgi

The kernel is pulling GUIDs from a cache. Can you reboot the operating system and repeat your actions?

ReplyQuote
Posted : 14/01/2017 1:59 am
jaclaz
(@jaclaz)
Community Legend

The kernel is pulling GUIDs from a cache.

Another good thing to know. )

The 3rd of january might well be the date of last boot.

The last 6005 and 6009 events in System Events are dated 03/01/2017 2022,43 (and since I am GMT+1 it would make more or less sense).

Can you reboot the operating system and repeat your actions?

No, I cannot reboot right now (this system is usually on 24/7), but I will repeat the test next time I reboot.

In any case the Object_ID continues to be not a "time stamp", but more like a "data point".

jaclaz

P.S. If you know of a decoder for these values, I would still be interested in it as the two mentioned online ones provide a different time
https://www.famkruithof.net/uuid/uuidgen
Tuesday, January 3, 2017 73126 PM GMT
vs
http//www.mahonri.info/cgi/uuid.cgi
Tue Jan 3 143126 2017 (+0.562504 seconds)

ReplyQuote
Posted : 14/01/2017 7:13 pm
Page 1 / 2
Share: