Timestamps
Last updated
Last updated
Windows DFIR notes are no longer maintained on InfoSec-Notes. Updated versions can be found on: .
On NTFS filesystems, each file posses (at least) two attributes that hold (among other information) Modification, Access, Change and Birth (MACB) timestamps:
$STANDARD_INFORMATION
$FILENAME
The impact of a number of operations on each timestamps for the $STANDARD_INFORMATION and $FILENAME attributes are detailed in the . Globally, the following points should be noted:
$FILENAME MACB timestamps are updated on file creation / copy / volume move with the date of the operation itself but are not reliability updated on regular file operations (access, modification, rename, deletion). However as the $FILENAME MAB timestamps are updated / copied from the $STANDARD_INFORMATION MAB timestamps on file rename or volume-local file move, they are prone to false-negatives. Indeed, by timestomping the $STANDARD_INFORMATION timestamps then renaming or moving the file, the $FILENAME timestamps will be indirectly timestomped as well.
On file copy (between two NTFS partitions): the $STANDARD_INFORMATION MC timestamps are inherited from the original file but the $STANDARD_INFORMATION AB timestamps (and the $FILENAME MACB timestamps) are the ones of the copy itself.
On local file moves (on the same NTFS partition), the $STANDARD_INFORMATION C $FILENAME C timestamps are updated with the timestamp of the move). On file moves (between NTFS partitions), the $STANDARD_INFORMATION AC timestamps are updated, also with the timestamp of the move.
The update of the $STANDARD_INFORMATION A timestamp is unreliable and depends on the value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate registry key. The following values may be encountered:
0 (default on Windows XP), 80000000 (User managed), 80000002 (System managed) means that last access updates are enabled. Starting from Windows Redstone 4 (Build 1803 of 04/2018), last access updates seem to be enabled (back) by default if the system partition size is <= to 128 GiB. Starting from Windows 10 20H1 (Build 18970 of 05/2020) last access updates seem to be enabled by default independently of the system partition size.
1 (default from Windows Vista to early Windows 10 versions), 80000001 (User managed), 80000003 means that last access updates are disabled.
Depending on its filename length, a given file may have one or two $FILENAME attributes:
file with short name will have a single $FILENAME attribute.
file with long name will be associated to two $FILENAME attributes, one for the long file name and a second for the MS-DOS-compatible short file name (FILENA~1.TXT for example).
Additionally, another $FILENAME attribute can be found for each file in the directory index of their directory of residency. Indeed directory are stored on NTFS partitions as B+ tree data structure with the keys, representing files and subdirectories, stored as $FILENAME attributes. MACB timestamps for each files and subdirectories of a given directory can thus be found in the directory index. The directory index are stored in NTFS Index Attribute files, also known as INDX files and named $I30 on disk.
A given file may thus be associated with either:
12 timestamps: $STANDARD_INFORMATION + $FILENAME + NTFS $I30's $FILENAME.
20 timestamps: $STANDARD_INFORMATION + 2 * $FILENAME + 2 * NTFS $I30's $FILENAME (duplicate timestamps for files with long name).
The last write / modified timestamp of a registry key correspond to the last time a write operation occurred on the key. Multiple types of write operation may trigger an update of the last write / modified timestamp of the key:
Addition / modification / deletion of one (or multiple) values under the key.
Addition / deletion of a sub-key under the key.
Change in the security descriptor (including Access Control List (ACL)) of the key.
The last write / modified timestamp of a registry key is the only generic timestamp available regarding registry keys.
Timestamps in Windows are often stored as UNIX time: 32-bit value containing the number of seconds elapsed since 1/1/1970.
Note that Active Directory generally store time values of objects (stored in each object's attributes) in Greenwich Mean Time (GMT).
The following one-liners can be used to convert an UNIX time to an human readable format:
https://www.sans.org/security-resources/posters/windows-forensic-analysis/170/download
https://forensicswiki.xyz/wiki/index.php?title=MAC_times
https://dfir.ru/2018/12/08/the-last-access-updates-are-almost-back/amp/