File systemwindowsPro

$MFT and the timestamp pair

Every NTFS file carries two sets of timestamps: $STANDARD_INFORMATION, which is what tools display and what an attacker can set, and $FILE_NAME, which is far harder to forge. Comparing them is how timestomping is caught.

What members see here

  • Every path this artifact lives at, and which builds each applies to.
  • What it proves, and what it does not prove, which is the part that matters.
  • How to parse it, and the tooling that reads it correctly.
  • Hunting queries for Splunk, Sentinel and Elastic, with their false-positive notes.