Windows Forensic Analysis Toolkit

File Metadata

The term metadata refers to data about data. The most commonly known metadata about files on Windows systems are the file MAC times; MAC stands for modified, accessed, and created. The MAC times are timestamps that refer to the time at which the file was last modified in some way (data was either added to the file or removed from it), last accessed (when the file was last opened), and when the file was originally created. How these times are managed by the operating system depends on the file system used. For example, on the FAT file system, times are stored based on the local time of the computer system, whereas the NTFS file system stores MAC times in Coordinated Universal Time (UTC) format, which is analogous to Greenwich Mean Time (GMT). When applications such as Windows Explorer display the MAC times, time zone and daylight savings settings need to be taken into account. Further, MAC time resolution for the FAT file system is 10 milliseconds for the creation time, 2 seconds for the modification time, and one day for the last access time (the date, really). For the NTFS file system, the last access time has a resolution of one hour.

Warning

On Windows systems, the NtfsDisableLastAccessUpdate Registry value (located in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem key) will allow you to disable (a DWORD value of 1 disables the functionality) the updating of last access times within the operating system. Although this is...

UNLIMITED FREE
ACCESS
TO THE WORLD'S BEST IDEAS

SUBMIT
Already a GlobalSpec user? Log in.

This is embarrasing...

An error occurred while processing the form. Please try again in a few minutes.

Customize Your GlobalSpec Experience

Category: File Compression Software
Finish!
Privacy Policy

This is embarrasing...

An error occurred while processing the form. Please try again in a few minutes.