ZEKASTRA

File systemsAdvancedFile system timestamps

NTFS $STANDARD_INFORMATION vs $FILE_NAME

Each NTFS MFT entry holds two sets of four FILETIMEs, in $SI and in $FILE_NAME; comparing them is a standard check for timestomping.

01Location

  • $MFT entry: $STANDARD_INFORMATION (type 0x10) and one or more $FILE_NAME (type 0x30) attributes; copies of $FILE_NAME also appear in parent $I30 index entries

02Questions it answers

  • Were the user-visible timestamps of a file altered after creation?
  • When was the file name created or last changed (rename, move)?
  • Do the short (8.3) and long names or hard links carry consistent times?

03Format and versions

Format$SI (resident, 48 or 72 bytes): creation, last modification, MFT entry modification, last access at offsets 0, 8, 16, 24. $FILE_NAME (resident): parent reference at 0, then the same four times at 8, 16, 24, 32, followed by sizes, flags and the UTF-16LE name.
Applies toAll NTFS versions; $SI is 72 bytes from NTFS 3.0. Times are UTC FILETIME values.

04Key fields

FieldWhat it tells you
$SI Creation / Modified / MFT modified / AccessedTimes shown to users by the file system view; the common target of timestomping.
$FN Creation / Modified / MFT modified / AccessedTimes in each file name attribute; changing them typically requires kernel interaction or moving or renaming the file (MITRE).
$FN parent file referenceMFT reference of the parent directory for that name.
$FN namespacePOSIX, Windows (long), DOS (8.3) or combined; one entry may hold several $FILE_NAME attributes, including one per hard link.

05Timestamps

FieldEncodingNote
All eight valuesFILETIME: 64-bit count of 100 ns intervals since 1601-01-01 UTCNTFS records times in UTC; last access updates can be deferred by up to one hour.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

06Examination workflow

  1. Parse the MFT entry and extract $SI and every $FILE_NAME attribute with full 100 ns precision.
  2. Flag entries where $SI creation is earlier than $FN creation, or where $SI and $FN values are identical in a way that suggests both were set together.
  3. Compare $SI MFT-modified time with the other $SI values: SetFileTime sets only creation, last access and last write.
  4. Corroborate with independent sources such as the USN journal, $LogFile, link files and event logs before concluding.

07Interpretation pitfalls

  • $SI/$FN mismatches also arise from legitimate operations (copying, extracting archives, renames); a mismatch is an indicator, not proof.
  • MITRE describes 'double timestomping' that sets both attributes, which defeats a simple comparison.
  • $FILE_NAME size fields are not always accurate in MFT attributes (libyal, citing Carrier).
  • MFT entries without $STANDARD_INFORMATION but with $FILE_NAME have been observed; handle missing attributes explicitly.

09Sources

  1. libfsntfs — New Technologies File System (NTFS) format documentation Joachim Metz (GitHub) · checked 2026-10-14
  2. Indicator Removal: Timestomp (T1070.006) MITRE ATT&CK · checked 2026-10-14
  3. FILETIME structure Microsoft Learn · checked 2026-10-14
  4. SetFileTime function Microsoft Learn · checked 2026-10-14
  5. File Times Microsoft Learn · checked 2026-10-14