OBSCURA OS
Settings

Read an NTFS $MFT, and Catch the Dates That Were Rewritten MFT

Every NTFS file keeps two sets of dates: the ones Windows shows and a program can change, and the ones the kernel writes and almost nothing exposes. When they disagree, the file was timestomped.

1. The table

A $MFT extracted from an NTFS volume. It is read here and never written to, and nothing is uploaded.

Drop $MFT here, or open it Exported from the volume root by a forensic imager. Large files are read up to what the browser can hold.

No file open yet.

Reading the two sets of dates

The columns show the $STANDARD_INFORMATION times, the ones Explorer shows and a program can set. A highlighted row is one where those disagree with the $FILE_NAME times the kernel wrote - the shown creation date is earlier than the name existed, or its sub-second precision was wiped. That is the shape of timestomping. It is a lead, not a verdict: corroborate against the change journal, the registry and the event logs, and remember a wrong clock skews every date together. Hash the copy with CHECKSUM and note its source with CHAIN first.