Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
File times on this host were altered to hide activity.
Collect first, these expire. The change journal records the rename or the write even when the timestamps have been rewritten to hide it, and it rolls by size. Collect it first.
survivesLong — often the full life of the installation.
does not proveExecution, despite being widely cited as an execution artifact — presence is what it records
the trap
Anything that reads only $STANDARD_INFORMATION, which is most tooling and every file listing. That is exactly the set a timestomper writes.
if you find nothing
Compare $STANDARD_INFORMATION against $FILE_NAME. Whole-second values with a zeroed sub-second field are a strong tell: genuine NTFS timestamps carry 100-nanosecond precision.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
