MAC Timestamps
Definition
Modified, Accessed, and Changed or Created times. Different file systems use the letters differently: on POSIX it is mtime, atime, ctime (change time); on NTFS it is Modified, Accessed, Created, and MFT-Modified.
- POSIX meaning
- mtime, atime, ctime (change time)
- NTFS meaning
- Modified, Accessed, Created, MFT-Modified
- Common pitfall
- Same acronym, different meaning per filesystem
- Forensic use
- Establishing file activity timelines
Common questions
Why does the ambiguity between filesystems matter to an examiner?+
An examiner moving between a POSIX system and an NTFS system must remember that the letter C means something different on each, change time versus creation time, and misreading it can lead to an incorrect timeline of file activity in a report.
Can MAC timestamps be trusted at face value?+
Not always. They can be altered by legitimate activity such as file copies, backups, or antivirus scans, or deliberately manipulated with timestomping tools, so examiners corroborate them with other artefacts such as journal entries or event logs where possible.
Related terms
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Journal (File-System)
- A circular log of file-system changes that allows recovery after a crash. NTFS keeps $LogFile, ext3/ext4 keep a dedicated journal block, APFS...
- Kernel Space vs User Space
- Kernel space is the privileged execution mode where the OS schedules processes, drives hardware and enforces memory protection. User space is the...
- MBR vs GPT
- Master Boot Record is the legacy partition table at LBA 0, limited to 4 primary partitions and 2 TiB. GUID Partition Table...
- Volume Shadow Copy
- Windows' snapshot mechanism (VSS). Creates point-in-time copies of files and folders. Examiners find shadow copies particularly useful because users rarely know the...