Training
Get a free hour of SANS training

Experience SANS training through course previews.

Learn More
Learning Paths
Can't find what you are looking for?

Let us help.

Contact us
Resources
Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations
Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Talk with an expert

Windows 7 MFT Entry Timestamp Properties

Authored byRob Lee
Rob Lee

I have been doing some research on and off for the past week or so on what updates an MFT Entries time value properties in "$STDINFO" and "$FILENAME".

Windows-Time-STDINFO_(1).jpgWindows-Time-FILENAME2.jpg

Rob has over a decade of experience in computer forensics, vulnerability discovery, intrusion detection and incident response. Rob is the lead course author and faculty fellow for the computer forensic courses at the SANS Institute and lead author for FOR408 Computer Forensic Essentials and FOR508 Computer Forensics Investigations and Incident Response.

SANS Digital Forensics and Incident Response Blog | Windows 7 MFT Entry Timestamp Properties | SANS Institute