File Systems and Storage Media Analysis
Structures that answer questions
Understand partition schemes (MBR with its 4-primary-partition limit, GPT with backup headers and CRC), then the file systems. On NTFS, the Master File Table holds one record per file, with attributes including $STANDARD_INFORMATION and $FILE_NAME, each carrying its own MACB timestamps. Also know $LogFile (transaction journal), $UsnJrnl (change journal), alternate data streams, the cluster bitmap, and the MFT mirror. On FAT/exFAT, expect simpler directory entries, local-time timestamps, and coarse granularity. On ext3/ext4, know inodes, the journal, extents, and nanosecond timestamps; on APFS, copy-on-write, snapshots, and clones; on HFS+, the catalog and extents B-trees.
Analysis techniques include recovering deleted files (metadata remnants, directory entry reuse), carving by signature from unallocated space, examining file slack and unallocated clusters, and resolving partition and volume boundaries.
Traps
NTFS timestamps are the classic trap: $STANDARD_INFORMATION timestamps can be altered by user-mode APIs (timestomping), while $FILE_NAME timestamps update mainly on rename or move. A $FILE_NAME creation time later than the $STANDARD_INFORMATION creation time is suspicious. FAT stores local time and is not time-zone-aware; NTFS stores UTC. "Modified" and "accessed" have different reliability depending on OS settings.
Worked example: an executable shows a creation time of 2019 in $STANDARD_INFORMATION but 2024 in $FILE_NAME. The most likely explanation is timestomping of the standard-information attribute, or the file was renamed into place in 2024 - investigate with $UsnJrnl and $LogFile before concluding.