Authoritative Defin...
 
Notifications
Clear all

Authoritative Definitions of MFT timestamps

5 Posts
4 Users
0 Reactions
1,982 Views
(@craznar)
Posts: 2
New Member
Topic starter
 

I'm looking for a definitive definition of each of the 8 timestamps in an MFT File Record.

Attr 0x10 Offset 0x50 File created 
Attr 0x10 Offset 0x58 File modified 
Attr 0x10 Offset 0x60 Record changed 
Attr 0x10 Offset 0x68 Last Access 
Attr 0x30 Offset 0xB8 File created 
Attr 0x30 Offset 0xC0 File modified
Attr 0x30 Offset 0xC8 Record changed
Attr 0x30 Offset 0xD0 Last Access

 

What I'm looking for:

  1. Correct names for each offset
  2. What it stores precisely
  3. When exactly is it updated
  4. What each of the different sets of times means

So far I've got various snippets from discussion forums, from various software vendors and text books - but no amount of google of GPT4 searches gives me anything definitive.

Can anyone here help?

Thanks

 

 

 

 

 
Posted : 20/04/2023 6:32 am
(@v-katalov)
Posts: 52
Trusted Member
 

Here is some good info on that:

http://www.kazamiya.net/en/NTFS_Timestamps

 
Posted : 20/04/2023 2:55 pm
(@craznar)
Posts: 2
New Member
Topic starter
 

Posted by: @v-katalov

Here is some good info on that:

I'd already checked that one out along with others - including:

https://www.forensicfocus.com/articles/interpretation-of-ntfs-timestamps/

<a href=" removed link "> removed link

However, I was looking for definitive information rather than second hand information.

In the several hours research I've done since posting this  thread, I'm coming to the realisation there possibly is no such authoritative source.

 
Posted : 20/04/2023 2:58 pm
(@athulin)
Posts: 1158
Noble Member
 

As far as I know, MFT structures are not documented by Microsoft. After all, users are not supposed to manipulate them directly. If that is correct, you won't find anything that can be called 'authoritative', unless you find some old article on the design of NTFS by a Microsoft author that includes such details. (Brian Carrier used some names in his book -- he might have documented his source(s).)

The best you can do is, I believe, go for the Microsoft documentation and/or different SDK's. You will find articles such as:

https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-setfileinformationbyhandle

which accepts a LP_BASIC_INFO structure, in which there are four timestamps named, for example.  Those are the names I preferred to use to describe the fields, when I had to. 

However ... that is only what this particular API calls the time stamps.  There are probably similar documentation for .NET, but I'm less familiar with those.

Other fields you list may not even be open to direct modification by user.

And authoritative info about exactly how they are used and when is something you have to ask Microsoft about.  They have some kind of forensic liaison -- that may be the source.  More likely is that you'll be informed that information can be obtained by licensing the NTFS file system source code. You'll need to sign an NDA for that, though.

 

 
Posted : 28/04/2023 2:29 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

I quite like the flatcap NTFS documentaton, its basically used for the Linux driver (I believe)

https://flatcap.github.io/linux-ntfs/ntfs/attributes/index.html

 
Posted : 09/05/2023 1:13 pm
Share: