I understand NTFS file timestamp metadata includes the following:

  • Created
  • Accessed
  • Modified

This data is accessible in the Windows Explorer UI and elsewhere.

However, I believe the timestamp metadata includes

  • Changed

Apparently the Changed timestamp is when the file's master file table entry was changed (see https://app.pluralsight.com/library/courses/digital-forensics-file-systems-getting-started/).

How can I get access to this value?

New contributor
fractor is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Do you need access specifically through Windows APIs? – grawity Dec 6 at 13:18
  • Ultimately, yes maybe. However, initially I'd just like to see it's value to see if it helps what I'm trying to do. I have an installation that puts files on the machine with Created dates in the past. I wanted to have a look at the Changed timestamp and see if it gives a more useful value. – fractor Dec 6 at 14:25
  • I've posted a question related to the Created date superuser.com/questions/1381364/… – fractor Dec 6 at 14:33
up vote 1 down vote accepted

According to my findings, the file Change Time field, also called MFT Timestamp, is not retrieved by using standard API functions, that only return the three standard times of created, modified and accessed.

To get the Change Time, you need to read the MFT entry of the file and analyze it yourself.

You will find an example PowerShell script that retrieves all MFT data in Technet :
Get MFT (ChangeTime) Timestamp of a file.

An explanation of this script by the author is found in the article :
Finding a File’s MFT Timestamp using PowerShell.

Your Answer

fractor is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.