## File System Analysis: NTFS & Timestamps

The file system acts as the librarian of the drive.

### NTFS (New Technology File System)
The standard Windows file system.
*   **$MFT (Master File Table)**: The heart of NTFS. It is a hidden file that contains a record for *every* file on the drive.
    *   It stores: File Name, Size, Permissions, Timestamps, and **Physical Location** on disk.
*   **Resident Files**: If a file is very small (< 700 bytes), NTFS stores the content *directly inside the MFT record* to save space.
*   **Deleted Files**:
    *   When you delete a file, Windows does NOT erase the data.
    *   It simply marks the MFT entry as "Free".
    *   The data stays on the disk until a new file overwrites it. This is why forensics can recover deleted files.

### Timestamps (MAC Times)
Every file has 4 timestamps (Standard MAC + Entry Modified).
*   **M**odified: Content changed. (e.g., "Save" in Word).
*   **A**ccessed: File read/opened. (Looking at a picture).
*   **C**reated: File created on *this* volume. (Moving a file updates Created Date!).
*   **B**orn (Entry Modified): The MFT record changed.

### Time Stomping
Attackers can use tools (like `touch` or `SetMace`) to modify timestamps to hide their tracks.
*   *Detection*: Often they miss the "nanosecond" precision or the $FileName attribute (NTFS has two sets of timestamps: $Standard_Information and $FileName). If they mismatch, it's stomping.