In my recent investigation, I tried to run TZWorks sbag on the hive files extracted from an HDD image, to find the evidence that files were copied from HDD to external USB drive. I did find the similar directory structure on external USB drive in sbag output. But the MAC timestamps of these items really confused me.
Here is one of the directories,
regdate reg-UTC 01/21/2014 163507.224
mdate time-UTC 01/16/2014 074424
adate time-UTC 01/19/2014 062216
cdate time-UTC 01/19/2014 062218
type dir
full path Desktop\{CLSID_MyComputer}\D\abc.Archive\xyz\
where the MAC timestamps of directory D\abc.Archive\xyz\ are,
Modified 01/16/2014 074424
Accessed 01/19/2014 062216
Created 01/19/2014 062218
The modified timestamp is exactly the same as the directory, of the same name, on the HDD.
I assume the filesystem of this USB drive is NTFS, since the accessed time is not 120000. According to http//