1

following problem:

A file is marked as being deleted without a tracked time-deletion date. However, timestamps such as File Accessed, Entry Modified etc. point e. g. to the 30.12.2019. Is it safe to assume that the deletion must have happened at or later than the 30.12.2019 as the file was accessed/created/modified/changes in the mft entry occured or are there other operations that might have triggered the timestamp changes apart from user actions after the file deletion?

1

After a file is deleted, there are no updates to the MFT entry, so yes the deletion occurred on or after 30.12.2019.

Caveats:

This assumes normal functionality. Clearly specialized tools can muck with the MFT.

If all the MAC time stamps are the same (in particular the modified time), then the file was deleted directly bypassing the Recycle Bin. Had it gone to the Recycle Bin, it would have been renamed with a new modified time. Similarly most wiping programs rename first with a new modified time created prior to the actual wipe.

You may be able to find the actual deletion time in the MFT Journal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.