NTFS Timestamp changes on Windows 10

[BigBrother]

During my File System Tunneling related investigation I tested NTFS timestamp changes in case of different operations on Windows 10. I used SANS’s DFPS_FOR500_v4.9_4-19 and Cyberforensicator’s timestamp posters for comparison. I found out that my results were different from theirs. In my tests, some of the operations produced different timestamp changes and inheritance than the previously mentioned posters show. These timestamp rules can change in every Windows version so it is worth checking them from time to time. I experimented with some basic operations, compared them to the above-mentioned posters, and documented my findings in this post.

Read The Full Article @ https://forensixchange.com/posts/19_04_22_win10_ntfs_time_rules/