File properties / metadata - NTFS and FAT32


How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?

Only 1, and it just get overwritten by the filesystem?

Thank you
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?

Only 1, and it just get overwritten by the filesystem?

Thank you
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
You’ve asked that three times, and it’s easily found on the Internet.

The answer is one for each date field, which makes sense. How many times can a file be created? How many times can a file be last written?
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Core i7-1260P
    Motherboard
    NUC12WSBi7
    Memory
    64 GB Micron PC4-25600
    Graphics Card(s)
    Intel Iris Xe Graphics
    Sound Card
    on-board Realtek HD Audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840 x 2160
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Crucial MX500 2 TB
    Antivirus
    Microsoft Defender
Some of the explanations here just don't ring true. So you have say a NAS machine running Linux with an XFS Linux file system. You transfer from Windows to the NAS the file(s) you want from Windows - say source file is in NTFS. Using any Linux browser you will see the file is on an XFS directory if that's where the target directory is -- whether you can open it is another matter but often these servers are just use for backup and you should be able to retrieve the file and use it normally on the Windows machine.

Now from that NAS you transfer those files back to Windows to another laptop- usually with something like SAMBA on the remote Linux machine -- and the original file is identical to the windows file you originally transferred from another Windows machine. Presumably the only difference in any of the files attributes might be the timestamp. Otherwise no loss in meta data.

I'm not a Windows expert but I've transferred enough files to and from Windows via Linux machines and haven't lost any data. I've no idea how the internal structures of the files are on either system but as a user I know the data is identical - even photo EXIF data.

Cheers
jimbo
 

My Computer

System One

  • OS
    Windows XP,11 Linux Fedora Rawhide pre-release 45
    Computer type
    PC/Desktop
    CPU
    2 X Intel i7
    Screen Resolution
    4KUHD X 2
Was there a question in there somewhere or were you just mentioning Linux again for no reason?
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Core i7-1260P
    Motherboard
    NUC12WSBi7
    Memory
    64 GB Micron PC4-25600
    Graphics Card(s)
    Intel Iris Xe Graphics
    Sound Card
    on-board Realtek HD Audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840 x 2160
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Crucial MX500 2 TB
    Antivirus
    Microsoft Defender
We've already explained EXIF data is part of the image file, regardless of the host OS or filesystem type.

Other metadata can be created by Windows on your behalf, to be shared with other Windows apps which are aware of the NTFS alternate streams. Neither SAMBA nor XFS are going to preserve that Windows-specific metadata, unless someone builds an emulation layer that captures it in a separate SAMBA database.

Alternate data streams aren't just tiny metadata blobs, they could be large data streams which are used by more sophisticated apps. SAMBA wouldn't deal with that because XFS doesn't have an equivalent file type or structure.
 

My Computer

System One

  • OS
    Windows 7
We've already explained EXIF data is part of the image file, regardless of the host OS or filesystem type.

Other metadata can be created by Windows on your behalf, to be shared with other Windows apps which are aware of the NTFS alternate streams. Neither SAMBA nor XFS are going to preserve that Windows-specific metadata, unless someone builds an emulation layer that captures it in a separate SAMBA database.

Alternate data streams aren't just tiny metadata blobs, they could be large data streams which are used by more sophisticated apps. SAMBA wouldn't deal with that because XFS doesn't have an equivalent file type or structure.
My questions are only related to a Windows NTFS / Windows NTFS context

How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?
-
Only 1

Only 1, and it just get overwritten by the filesystem?
-
Yes

Agree?

Is there only 1 MFT entry timestamp for a file?

Thank you
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
My questions are only related to a Windows NTFS / Windows NTFS context

How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?
-
Only 1

Only 1, and it just get overwritten by the filesystem?
-
Yes

Agree?

Is there only 1 MFT entry timestamp for a file?

You’ve asked that three four times, and it’s easily found on the Internet.

The answer is one for each date field, which makes sense. How many times can a file be created? How many times can a file be last written?
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Core i7-1260P
    Motherboard
    NUC12WSBi7
    Memory
    64 GB Micron PC4-25600
    Graphics Card(s)
    Intel Iris Xe Graphics
    Sound Card
    on-board Realtek HD Audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840 x 2160
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Crucial MX500 2 TB
    Antivirus
    Microsoft Defender
Here's a research paper discussing the internal data structures of NTFS timestamps, and examples of how different Windows actions will affect the timestamp data. And how to check for forgeries, by comparing the timestamps against other NTFS attributes.

It's kinda academic, but a solid analysis of the topic.

Time for Truth: Forensic Analysis of NTFS Timestamps
 

My Computer

System One

  • OS
    Windows 7
In regard of #17

So I can conclude, that the NTFS journaling will not follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Regarding NTFS MFT entry modified:
Is there only 1 MFT entry timestamp for a file?

Does NTFS MFT entry modified timestamp follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Thank you
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
Here's a research paper discussing the internal data structures of NTFS timestamps, and examples of how different Windows actions will affect the timestamp data. And how to check for forgeries, by comparing the timestamps against other NTFS attributes.

It's kinda academic, but a solid analysis of the topic.

Time for Truth: Forensic Analysis of NTFS Timestamps
I had hoped someone could answer it simply, and it not would require an academic study to conclude. But thank you.

In regard of #17

So I can conclude, that the NTFS journaling will not follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Regarding NTFS MFT entry modified:
Is there only 1 MFT entry timestamp for a file?

Does NTFS MFT entry modified timestamp follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
Oy…. double posting two minutes apart.
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Core i7-1260P
    Motherboard
    NUC12WSBi7
    Memory
    64 GB Micron PC4-25600
    Graphics Card(s)
    Intel Iris Xe Graphics
    Sound Card
    on-board Realtek HD Audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840 x 2160
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Crucial MX500 2 TB
    Antivirus
    Microsoft Defender
Would anyone please come with their best educated guess regarding #32

If they agree?

Thank you
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
Back
Top Bottom