File properties / metadata - NTFS and FAT32

How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?

Only 1, and it just get overwritten by the filesystem?

Thank you

How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?

Only 1, and it just get overwritten by the filesystem?

Thank you

You’ve asked that three times, and it’s easily found on the Internet.

The answer is one for each date field, which makes sense. How many times can a file be created? How many times can a file be last written?

Some of the explanations here just don't ring true. So you have say a NAS machine running Linux with an XFS Linux file system. You transfer from Windows to the NAS the file(s) you want from Windows - say source file is in NTFS. Using any Linux browser you will see the file is on an XFS directory if that's where the target directory is -- whether you can open it is another matter but often these servers are just use for backup and you should be able to retrieve the file and use it normally on the Windows machine.

Now from that NAS you transfer those files back to Windows to another laptop- usually with something like SAMBA on the remote Linux machine -- and the original file is identical to the windows file you originally transferred from another Windows machine. Presumably the only difference in any of the files attributes might be the timestamp. Otherwise no loss in meta data.

I'm not a Windows expert but I've transferred enough files to and from Windows via Linux machines and haven't lost any data. I've no idea how the internal structures of the files are on either system but as a user I know the data is identical - even photo EXIF data.

Cheers
jimbo

Was there a question in there somewhere or were you just mentioning Linux again for no reason?

We've already explained EXIF data is part of the image file, regardless of the host OS or filesystem type.

Other metadata can be created by Windows on your behalf, to be shared with other Windows apps which are aware of the NTFS alternate streams. Neither SAMBA nor XFS are going to preserve that Windows-specific metadata, unless someone builds an emulation layer that captures it in a separate SAMBA database.

Alternate data streams aren't just tiny metadata blobs, they could be large data streams which are used by more sophisticated apps. SAMBA wouldn't deal with that because XFS doesn't have an equivalent file type or structure.

garlin said:

We've already explained EXIF data is part of the image file, regardless of the host OS or filesystem type.

Other metadata can be created by Windows on your behalf, to be shared with other Windows apps which are aware of the NTFS alternate streams. Neither SAMBA nor XFS are going to preserve that Windows-specific metadata, unless someone builds an emulation layer that captures it in a separate SAMBA database.

Alternate data streams aren't just tiny metadata blobs, they could be large data streams which are used by more sophisticated apps. SAMBA wouldn't deal with that because XFS doesn't have an equivalent file type or structure.

Click to expand...

My questions are only related to a Windows NTFS / Windows NTFS context

How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?
-
Only 1

Only 1, and it just get overwritten by the filesystem?
-
Yes

Agree?

Is there only 1 MFT entry timestamp for a file?

Thank you

Into_Oblivion1 said:

My questions are only related to a Windows NTFS / Windows NTFS context

How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?
-
Only 1

Only 1, and it just get overwritten by the filesystem?
-
Yes

Agree?

Is there only 1 MFT entry timestamp for a file?

Click to expand...

pseymour said:

You’ve asked that three four times, and it’s easily found on the Internet.

The answer is one for each date field, which makes sense. How many times can a file be created? How many times can a file be last written?

Click to expand...

@pseymour, have you watched "Memento" by Christopher Nolan?

Here's a research paper discussing the internal data structures of NTFS timestamps, and examples of how different Windows actions will affect the timestamp data. And how to check for forgeries, by comparing the timestamps against other NTFS attributes.

It's kinda academic, but a solid analysis of the topic.

Time for Truth: Forensic Analysis of NTFS Timestamps

In regard of #17

So I can conclude, that the NTFS journaling will not follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Regarding NTFS MFT entry modified:
Is there only 1 MFT entry timestamp for a file?

Does NTFS MFT entry modified timestamp follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Thank you

garlin said:

Here's a research paper discussing the internal data structures of NTFS timestamps, and examples of how different Windows actions will affect the timestamp data. And how to check for forgeries, by comparing the timestamps against other NTFS attributes.

It's kinda academic, but a solid analysis of the topic.

Time for Truth: Forensic Analysis of NTFS Timestamps

Click to expand...

I had hoped someone could answer it simply, and it not would require an academic study to conclude. But thank you.

In regard of #17

So I can conclude, that the NTFS journaling will not follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Regarding NTFS MFT entry modified:
Is there only 1 MFT entry timestamp for a file?

Does NTFS MFT entry modified timestamp follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Oy…. double posting two minutes apart.

Would anyone please come with their best educated guess regarding #32

If they agree?

Thank you