CSCC LABS

MAC (b) Times

The MAC (b) times are derived from file system Metadata.

MACB stands for:

  • Modified
  • Accessed
  • Changed ($MFT Modified)
  • Birth (File Creation Time)

Not all file systems record a birth time. Only NTFS Files systems will record it.

Where are MACB times stored?

It is basically stored in…

--

--

CSCC LABS

CSCC LABS

Cybersecurity Comprehensive Coverage