# File System Artifacts

Beyond the registry and logs, the NTFS file system itself leaves dozens of clues about user behavior and file manipulation.

## Master File Table (MFT)
NTFS uses a database called the Master File Table (MFT) to track every single file and folder on the volume. The file itself is called `$MFT`. 

*   **MACB Timestamps:** The MFT records four critical timestamps for every file:
    *   **M**odified: When the file contents were last changed.
    *   **A**ccessed: When the file was last opened/read.
    *   **C**reated: When the file was first created on this volume.
    *   **MFT Modified (B for birthed/metadata):** When the file's metadata (permissions, name) was last changed.
*   **Time Stomping:** Advanced attackers use anti-forensic tools to alter MAC timestamps to make malicious files blend in (e.g., changing malware creation date to 2018). However, it is very difficult to successfully forge the 'MFT Modified' timestamp, meaning forensic tools can often detect time stomping.

## Windows Shortcut Files (.lnk)
When a user opens a file, Windows often automatically creates a shortcut (`.lnk`) file pointing to it (e.g., in the "Recent Items" folder). 

*   **Forensic Value:** LNK files are gold. They contain metadata about the target file *and* the system it was on. Even if the target file was on a USB drive that is now gone, the LNK file left behind tells us:
    1.  The original path of the file.
    2.  The MAC timestamps of the target file.
    3.  The Volume Serial Number of the USB drive it was on.
    4.  The MAC address of the machine where the file was originally created.

## The Recycle Bin
When a user "deletes" a file, Windows doesn't actually erase the 1s and 0s. Firstly, it just moves the file to a hidden system folder called `$Recycle.Bin`. 

Inside the Recycle Bin, Windows splits the deleted file into two pieces:
1.  **$R file:** The actual contents of the deleted file, renamed with a random string ($R123456.docx).
2.  **$I file:** A metadata file containing the *original name* of the file, its *original path* before it was deleted, and the exact *timestamp* it was deleted.

If you find a suspicious file in the Recycle Bin, parsing its corresponding `$I` file tells you exactly where it came from and when the suspect tried to get rid of it.