Contents
What do you need to know about file timestamps?
File system information like file-naming schemes, file locations, and file timestamp information. Metadata from the multimedia formats like video codec, audio codec, audio bit rate, and timestamps. Table 8.2 shows some differences in file system information and metadata between different phone types. Table 8.2.
Where do I find the timestamp on my computer?
Some of the timestamps exist on one file system but can be non-existent on other. Also their meaning can vary depending on the different filesystems. Here is a table from sleuthkit’s site about the meaning of timestamps. Windows stores these timestamp values in the $MFT (Master File Table).
How to compare timestamps of files in a batch?
Compare first the years, then the months, then the day, then AM/PM, then the hour, and then the minute and second, (actually time consuming, but I don’t have on the minute a better idea), see the final code at the end. However this solution will not work if the files are in the same minute but different by the second.
Why is the access timestamp different in Windows 10?
The Modification and Metadata got the values of the execution time and date while the Access was set to a bit later time (~2 secs). I have done this test multiple times and in every scenario, the Access timestamp was differed from the other two. I got different results from Cyberforensicator or SANS.
Are there any timestamp changes in Windows 10?
Based on my test the $STD Modification, Access and Metadata timestamps were the only ones which were updated. The interesting value here is the time of the Access timestamps. The Modification and Metadata got the values of the execution time and date while the Access was set to a bit later time (~2 secs).
Is the access timestamp on my NTFS file changed?
The $FN values are untouched according to SANS but in its case, the Access timestamp is not changed. However, it was changed in mine. Thus, it looks like all three of the results are a little bit different in relation to file modification. The command I used to create and modify the file: