Windows MACB Timestamps (NTFS Forensics)

As a continuation of the "Introduction to Windows Forensics" series, this video introduces the concept of MACB (modification, access, MFT record change, birth/creation) timestamps associated with files on NTFS volumes. We will first cover the basics of MACB timestamps and the differences between the $STANDARD_INFORMATION and $FILE_NAME attributes; secondly, we will look at normal timestamp behavior on a Windows 10 system when creating, modifying, copying, and accessing files; next, we will use an anti-forensics tool known as “Timestomp” to modify a file’s MACB (MACE) timestamps; then we’ll use a tool called analyzeMFT to find evidence of timestomping; lastly, we’ll take a look at something interesting I recently discovered with regards to how these timestamps work when using the new Bash on Windows (Windows Subsystem for Linux) feature.

Introduction to Windows Forensics:

MAC Times:

I’m Your MAC(b) Daddy:

Timestomp:

analyzeMFT:

Digital Forensics: Detecting Time Stamp Manipulation:

#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics

[brentbott]

I really appreciate how well you explain the content to the least common denominator (me).

[vero]

I passed my GCFA yesterday due to this video and your others! Tough test, but your content really helped. Just became a patron - thanks for what you do!

[beb]

This is really a very informative video.. all you need to know about the title and new discovery. Thank you for the efforts in putting it all together.

[travelmore]

I've begun watching your videos recently and they're extremely useful! Thanks a lot

[berndeckenfels]

You can use the Linux „stat“ command to see file Attributes, it will show birth time for some filesystems as well. (%w Format String)

[packy]

Thank you so much! I am working on my GCFE and these videos are helping me alot. 🙏

[krithikaramakrishnan]

Thank you so much for the explanation :)

[anthonyc]

Great job on the content. This helped reinforce some of the learning material from SANS 508. Keep up the great videos!

[PradeepSharma-ytik]

Great Job, Awesome content, perfect flow..you never let audience sleep..keep it up...I will wait for more new videos

[RandomNullpointer]

You are a great teacher!

Regarding the copy on bash, I'd assume that it's not calling the native OS function to copy, but rather it is scripted internally, so it creates a new file, possibly forgetting to set the timestamps later (as it is in beta).
Now things may have changed, but I don't know really, as I don't use bash.

[dewy]

I have Win 10 22H2 and it appears that when I modify a file, the Accessed time is also changing. Wondering if the default changed in the recent versions.

[Mack]

Great Video sir! Thanks for sharing :-)

[MrSanjay]

Hello @13Cubled I have tried to change file content and i observed there is modification and access time stamp is change. as per your video access time stamp is not changes. and my drive type is NTFS as well.

[TheSkepticSkwerl]

It's likely that the bash program copies quite literally by redirecting the output of the file into a new file. So it creates a file, and then copies all the data into it.

[stagesnake]

Date Accessed has been updated. I tried this in Windows 10 and it updated along with the modification date.

[PavloDeneka_]

Would be interesting if you will make a video about Steganography and Cryptography.

[modogg]

IT would also be great to do a SANS SIFT Video

[miss_tech]

the timestomp tool isnt out there anymore ?

[kasperkasper]

NTFS says that $Filename attribute timestamps will be changed if file renaming happens. But according to SANS table timestamps rules (file rename column) there is no modification of any $FN timestamps, why its so?

[kazdaman]

Thanks it was a good video.


Just a thought, maybe adding '-p' to the bash cp command will preserve the timestamps. This is how it works on Linux.