Talk With an Expert

Windows 7 MFT Entry Timestamp Properties

Authored byRob Lee
Rob Lee

I have been doing some research on and off for the past week or so on what updates an MFT Entries time value properties in "$STDINFO" and "$FILENAME".

Windows-Time-STDINFO_(1).jpgWindows-Time-FILENAME2.jpg

Rob has over a decade of experience in computer forensics, vulnerability discovery, intrusion detection and incident response. Rob is the lead course author and faculty fellow for the computer forensic courses at the SANS Institute and lead author for FOR408 Computer Forensic Essentials and FOR508 Computer Forensics Investigations and Incident Response.