MAC Timestamps
Definition
Modified, Accessed, and Changed or Created times. Different file systems use the letters differently: on POSIX it is mtime, atime, ctime (change time); on NTFS it is Modified, Accessed, Created, and MFT-Modified.
Related terms
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Journal (File-System)
- A circular log of file-system changes that allows recovery after a crash. NTFS keeps $LogFile, ext3/ext4 keep a dedicated journal block, APFS...
- Kernel Space vs User Space
- Kernel space is the privileged execution mode where the OS schedules processes, drives hardware and enforces memory protection. User space is the...
- MBR vs GPT
- Master Boot Record is the legacy partition table at LBA 0, limited to 4 primary partitions and 2 TiB. GUID Partition Table...
- Volume Shadow Copy
- Windows' snapshot mechanism (VSS). Creates point-in-time copies of files and folders. Examiners find shadow copies particularly useful because users rarely know the...
Explained in
- Operating Systems, Boot Process and File SystemsModified, Accessed, and Changed or Created times. Different file systems use the letters differently: on POSIX it is mtime, atime, ctime (change time); on NTFS...