02 Timestamps Overview

Topic Progress:

What are they?

Timestamps are data that indicate the time of certain events (MAC):

  • Modification – when a file was modified
  • Access – when a file or entries were read or accessed
  • Creation – when files or entries were created

Types of timestamps

  • Modified
  • Accessed
  • Created
  • Date Changed (MFT)
  • Filename Date Created (MFT)
  • Filename Date Modified (MFT)
  • Filename Date Accessed (MFT)
  • INDX Entry Date Created
  • INDX Entry Date Modified
  • INDX Entry Date Accessed
  • INDX Entry Date Changed

Why do we care?

Certain events such as creating, moving, copying, opening, editing, etc. might affect the MAC times. If the MAC timestamps can be attained, a timeline of events could be created.

Timeline Patterns

There are plenty more patterns than the ones introduced below, but these are the basics you should start with to get a good understanding of how it works, and to complete this challenge.

Timestamp type 1

Timestamp type 2

Timestamp type 3

Timestamp type 4

Timestamp type 5