thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

MAC Times (MACB)

File system timestamps recording when a file was Modified, Accessed, Changed (metadata) and Born (created).

Definition

In NTFS, the $STANDARD_INFORMATION and $FILE_NAME attributes each store four timestamps; comparing them can reveal timestomping. Behavior varies by OS and operation, and access time updates may be disabled. MACB times are core inputs to timelines.

Example

A malware file with a 2015 creation time in $SI but a 2026 time in $FN suggests timestomping.

Exam tip

Know that $SI timestamps are easily altered while $FN timestamps are harder to change.

Related terms