How do you identify and interpret file system metadata and timestamps?

由人工智能和领英社区提供技术支持

File system metadata and timestamps are crucial pieces of information for digital forensics, as they can reveal when, how, and by whom files were created, modified, accessed, or deleted. However, different file systems have different ways of storing and displaying these data, and some of them can be altered or manipulated by users or applications. In this article, you will learn how to identify and interpret file system metadata and timestamps for some of the most common file systems, such as NTFS, FAT, and EXT.

此文章中的业界达人

由社区从 1 条内容中精选。了解更多

Rahul Pawar

Global Vice President, Security GTM & CTO, GSS

1 NTFS Metadata and Timestamps

NTFS is the default file system for Windows operating systems, and it stores a lot of metadata and timestamps for each file and directory in its Master File Table (MFT). Each MFT entry has a set of attributes, such as Standard Information, File Name, Data, and Security Descriptor, that contain information such as the file name, size, location, permissions, and owner. The Standard Information and File Name attributes also store four timestamps for each file and directory: Created, Modified, Accessed, and MFT Changed. These timestamps record the date and time when the file or directory was created, modified, accessed, or had its MFT entry changed, respectively. However, these timestamps are not always reliable, as they can be affected by system settings, user actions, or malware. For example, the Modified and Accessed timestamps can be disabled or updated by copying or moving files, while the Created and MFT Changed timestamps can be altered by using tools or commands.

添加您的观点

Rahul Pawar

Global Vice President, Security GTM & CTO, GSS
举报内容
Windows change journal capture time stamp changes even when they are set back. However the change journal can role over in which case the info about the change can be lost. Change journals are noisy as well. However each file has an update sequence number(USN) which is a reliable indicator of a file change, although the type of actual change may be lost.

已翻译

赞

2 FAT Metadata and Timestamps

FAT is an older file system that was used by DOS and early versions of Windows, and it is still widely used for removable media, such as USB drives and memory cards. FAT stores metadata and timestamps for each file and directory in its File Allocation Table (FAT) and Directory Table (DT). The FAT records the clusters allocated to each file, while the DT records the file name, size, attributes, and three timestamps for each file and directory: Created, Modified, and Accessed. These timestamps record the date and time when the file or directory was created, modified, or accessed, respectively. However, these timestamps are also not very accurate, as they have a low resolution of two seconds for the Modified timestamp and one day for the Accessed timestamp. Moreover, the Created timestamp can be overwritten by renaming or moving files, while the Modified and Accessed timestamps can be updated by opening or copying files.

添加您的观点

3 EXT Metadata and Timestamps

EXT is a family of file systems that are commonly used by Linux and other Unix-like operating systems, such as EXT2, EXT3, and EXT4. EXT stores metadata and timestamps for each file and directory in its Inode Table (IT) and Directory Entry (DE). The IT records the attributes, permissions, owner, size, and location of each file and directory, while the DE records the file name and the inode number that links to the IT. The IT also stores three timestamps for each file and directory: Created, Modified, and Accessed. These timestamps record the date and time when the file or directory was created, modified, or accessed, respectively. However, unlike NTFS and FAT, EXT does not store a separate timestamp for MFT or DT changes, which means that it is harder to detect if the metadata or timestamps have been tampered with. Moreover, some Linux distributions or applications may modify the timestamps by using tools or commands.

添加您的观点

4 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

File Systems

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you identify and interpret file system metadata and timestamps?

1

2

3

4

1 NTFS Metadata and Timestamps

2 FAT Metadata and Timestamps

3 EXT Metadata and Timestamps

4 Here’s what else to consider

File Systems

给文章评分

感谢您的反馈

更多File Systems相关文章

更多相关阅读内容