NTFS Timestamp Conflict on a Payroll Spreadsheet
You receive an E01 image of a 500 GB NTFS volume from a Windows Server 2016 file server. A spreadsheet named Q3_payroll.xlsx is central to an internal fraud inquiry. In $STANDARD_INFORMATION, the creation time is 2009-03-14 02:11:07, modified time 2024-08-02 22:41:19, and entry modified time 2024-08-02 22:41:19. In $FILE_NAME, creation time is 2024-08-01 16:03:52 and modified time 2024-08-01 16:03:52. The volume was formatted on 2014-06-18, and the server was installed then. The MFT record number is 184223, and the file occupies nonresident clusters. $LogFile and $UsnJrnl are present. The file's owner SID maps to a terminated contractor. The image hash verified at acquisition.
1. How should you interpret the conflict between the $STANDARD_INFORMATION and $FILE_NAME timestamps?
Read the worked answer
The $STANDARD_INFORMATION creation time predates the volume format by more than five years, while the $FILE_NAME creation time is 2024-08-01. A file cannot have been created on this volume in 2009 unless its metadata was restored or altered, so the $SI value is anomalous. The $FN timestamps are generally less easily changed through normal user-mode file operations, which makes the 2024-08-01 values more consistent with the file's appearance on this volume. However, the discrepancy alone does not prove timestomping: restoration from backup or a copy tool that preserves $SI creation time can also produce a mismatch. Treat it as a strong indicator requiring corroboration, not a conclusion.
2. Which artifacts would you examine to determine whether the timestamps were manipulated or preserved by restoration?
Read the worked answer
Correlate $LogFile and $UsnJrnl records for file creation, rename, and metadata changes around 2024-08-01 and 2024-08-02. Check MFT record slack and whether the record was reused. Compare subsecond timestamp precision and time zone settings. Look for volume shadow copies, backup catalogs, and restore logs that could explain preserved $SI creation time. Review SMB access auditing, EDR file events, and the contractor account's logon and termination dates. If the account was disabled before 2024-08-01, creation by that account becomes less plausible. The reasoning is to build a sequence from independent artifacts rather than rely on one timestamp pair.
3. How would you phrase the finding in the report without overstating it?
Read the worked answer
Write that the $SI creation timestamp predates the volume format and conflicts with the $FN creation timestamp by more than fifteen years. State that this is consistent with either metadata modification, including timestomping, or restoration or copying that preserved $SI creation time. Then list the corroborating artifacts examined and their results. If $LogFile or $UsnJrnl shows a metadata change near 2024-08-02, say so and explain its significance. Avoid a bare assertion that the file was created in 2009 or that the contractor created it. The report should distinguish observed timestamps, the anomaly, and the competing explanations, and it should state what additional evidence would resolve the uncertainty.