Forensic investigators can bypass attacker anti-forensic measures by correlating data from the Master File Table, USN Journal, and $LogFile to reconstruct accurate timelines of file system activity.

Key Points

• NTFS stores metadata in two MFT locations: $STANDARD_INFORMATION, which is easily modified, and $FILE_NAME, which is kernel-written and harder to alter.
• The USN Journal ($Extend\$UsnJrnl) provides a sequential, 20-day history of file system changes, including deletions and renames, that survives file removal.
• The $LogFile acts as a low-level transaction journal, allowing analysts to verify the actual time metadata attributes were last written.
• Tools like MFTECmd provide analyst-ready CSV outputs, while the dfir_ntfs Python library offers programmatic access to raw NTFS structures and volume shadow copies.
• Discrepancies between $SI and $FN timestamps serve as a primary indicator of timestomping, as the kernel prevents these values from diverging under normal operation.

Why it Matters

Attackers often attempt to hide their tracks by clearing logs and modifying file timestamps, but these actions rarely account for the redundant, layered nature of NTFS metadata. By cross-referencing these three independent data sources, investigators can expose malicious activity that would otherwise remain hidden, significantly increasing the reliability of digital forensic evidence.