There are two common misconceptions about NTFS:
- A typical file has 8 timestamps.
- Windows Explorer displays $STANDARD_INFORMATION timestamps.
A file with a single name has 12 timestamps: 4 timestamps come from the $STANDARD_INFORMATION attribute in a file record, 4 timestamps come from the $FILE_NAME attribute in the same file record, and 4 timestamps come from the $FILE_NAME attribute in an index record ($I30) of a parent directory.
If there is a short file name together with a long one, the number of timestamps is 20 (8 more timestamps come from two additional $FILE_NAME attributes in a file record and in an index record of a parent directory respectively).
You can also add an UUIDv1 timestamp from the $OBJECT_ID attribute, timestamps recorded in the USN journal and in the $LogFile journal. But these aren’t always present.
Things are more complicated with timestamps displayed by Windows Explorer.
Continue reading “$STANDARD_INFORMATION vs. $FILE_NAME”