Monday, September 9, 2019

NTFS Timestamps|

Qwerty uiop asd fghjkl zxcvb nm.

SHA1 C:\TestFolder\TestFile4095.tst 4c1732511805221435db376b8cbad7d0debf72cf

MFT Entry Header Values:
Entry: 124888        Sequence: 13
$LogFile Sequence Number: 537362867
Allocated File
Links: 2

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 2213  (S-1-5-21-2973299112-457765261-1731413466-1001)
Last User Journal Update Sequence Number: 101740432
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 06:57:40.000000000 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TESTFI~1.TST
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 0    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TestFile4095.tst
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 0    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 98
Type: $DATA (128-4)   Name: N/A   Non-Resident   size: 4095  init_size: 4095
33536
SHA1 C:\TestFolder\TestFile4095.tst 0dd646c5f8e3f61fa7cad72a68de06cc50d063c8

MFT Entry Header Values:
Entry: 124888        Sequence: 13
$LogFile Sequence Number: 537882948
Allocated File
Links: 2

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 2213  (S-1-5-21-2973299112-457765261-1731413466-1001)
Last User Journal Update Sequence Number: 101740432
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 06:57:40.000000000 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TESTFI~1.TST
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 0    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TestFile4095.tst
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 0    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 98
Type: $DATA (128-4)  Name: N/A  Non-Resident  size: 4095  init_size: 4095
33536
SHA1 C:\TestFolder\TestFile4096.tst 2b4104c0956ad137b3925920c7b8e4b3fd1df275

MFT Entry Header Values:
Entry: 124893        Sequence: 11
$LogFile Sequence Number: 537362895
Allocated File
Links: 2

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 2213  (S-1-5-21-2973299112-457765261-1731413466-1001)
Last User Journal Update Sequence Number: 101740928
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 06:57:34.000000000 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TESTFI~2.TST
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 4096    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TestFile4096.tst
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 4096    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 98
Type: $DATA (128-1)   Name: N/A   Non-Resident   size: 4096  init_size: 4096
100611
SHA1 C:\TestFolder\TestFile4096.tst ba31ebd88c9abf4462da0ee43228720ba7775098

MFT Entry Header Values:
Entry: 124893        Sequence: 11
$LogFile Sequence Number: 537362895
Allocated File
Links: 2

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 2213  (S-1-5-21-2973299112-457765261-1731413466-1001)
Last User Journal Update Sequence Number: 101740928
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 06:57:34.000000000 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TESTFI~2.TST
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 4096    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TestFile4096.tst
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 4096    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 98
Type: $DATA (128-1)   Name: N/A   Non-Resident   size: 4096  init_size: 4096
100611
SHA1 C:\TestFolder\TestFile3516592.tst
f87e2398de1c05a8c7fe7cd97097cdc1b69da6ab

MFT Entry Header Values:
Entry: 124894        Sequence: 11
$LogFile Sequence Number: 537367229
Allocated File
Links: 2

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 2213  (S-1-5-21-2973299112-457765261-1731413466-1001)
Last User Journal Update Sequence Number: 101741440
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 06:59:46.000000000 (UTC)
MFT Modified:  2019-08-31 07:45:13.164794500 (UTC)
Accessed:      2019-08-31 07:45:13.164794500 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TESTFI~3.TST
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 3518464    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TestFile3516592.tst
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 3518464    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 104
Type: $DATA (128-1) Name: N/A Non-Resident size: 3516592 init_size: 3516592
4363616 4363617 4363618 4363619 4363620 4363621 4363622 4363623 
...
4364464 4364465 4364466 4364467 4364468 4364469 4364470 4364471 
4364472 4364473 4364474
SHA1 C:\TestFolder\TestFile3516592.tst
8623d77cdd8b00e4966ba1056319a1db61aa8ce1

MFT Entry Header Values:
Entry: 124894        Sequence: 11
$LogFile Sequence Number: 537367229
Allocated File
Links: 2

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 2213  (S-1-5-21-2973299112-457765261-1731413466-1001)
Last User Journal Update Sequence Number: 101741440
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 06:59:46.000000000 (UTC)
MFT Modified:  2019-08-31 07:45:13.164794500 (UTC)
Accessed:      2019-08-31 07:45:13.164794500 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TESTFI~3.TST
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 3518464    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TestFile3516592.tst
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 3518464    Actual Size: 0
Created:       2019-08-31 07:45:12.772832300 (UTC)
File Modified: 2019-08-31 07:45:12.772832300 (UTC)
MFT Modified:  2019-08-31 07:45:12.772832300 (UTC)
Accessed:      2019-08-31 07:45:12.772832300 (UTC)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 104
Type: $DATA (128-1) Name: N/A Non-Resident size: 3516592 init_size: 3516592
4363616 4363617 4363618 4363619 4363620 4363621 4363622 4363623 
...
4364464 4364465 4364466 4364467 4364468 4364469 4364470 4364471 
4364472 4364473 4364474
SHA1 C:\TestFolder\TestFile235281024.tst
eb541e876895e8595e4fcb7322c183e7cabad382

MFT Entry Header Values:
Entry: 88106        Sequence: 10
$LogFile Sequence Number: 907469416
Allocated File
Links: 2

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 2213  (S-1-5-21-2973299112-457765261-1731413466-1001)
Last User Journal Update Sequence Number: 113449752
Created:       2019-09-03 09:14:18.591216000 (UTC)
File Modified: 2019-09-01 19:36:28.000000000 (UTC)
MFT Modified:  2019-09-03 09:14:44.548521800 (UTC)
Accessed:      2019-09-03 09:14:44.548521800 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TESTFI~4.TST
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 235282432    Actual Size: 0
Created:       2019-09-03 09:14:18.591216000 (UTC)
File Modified: 2019-09-03 09:14:18.591216000 (UTC)
MFT Modified:  2019-09-03 09:14:18.591216000 (UTC)
Accessed:      2019-09-03 09:14:18.591216000 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TestFile235281024.tst
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 235282432    Actual Size: 0
Created:       2019-09-03 09:14:18.591216000 (UTC)
File Modified: 2019-09-03 09:14:18.591216000 (UTC)
MFT Modified:  2019-09-03 09:14:18.591216000 (UTC)
Accessed:      2019-09-03 09:14:18.591216000 (UTC)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 108
Type: $DATA (128-1) Name: N/A Non-Resident size: 235281024 init_size: 235281024
3959582 3959583 3959584 3959585 3959586 3959587 3959588 3959589 
...
4017014 4017015 4017016 4017017 4017018 4017019 4017020 4017021 
4017022 4017023 
SHA1 C:\TestFolder\TestFile235281024.tst
66817762fe8f32e065ea8c824367bdc8f47a3093

MFT Entry Header Values:
Entry: 88106        Sequence: 10
$LogFile Sequence Number: 907469416
Allocated File
Links: 2

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 2213  (S-1-5-21-2973299112-457765261-1731413466-1001)
Last User Journal Update Sequence Number: 113449752
Created:       2019-09-03 09:14:18.591216000 (UTC)
File Modified: 2019-09-01 19:36:28.000000000 (UTC)
MFT Modified:  2019-09-03 09:14:44.548521800 (UTC)
Accessed:      2019-09-03 09:14:44.548521800 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TESTFI~4.TST
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 235282432    Actual Size: 0
Created:       2019-09-03 09:14:18.591216000 (UTC)
File Modified: 2019-09-03 09:14:18.591216000 (UTC)
MFT Modified:  2019-09-03 09:14:18.591216000 (UTC)
Accessed:      2019-09-03 09:14:18.591216000 (UTC)

$FILE_NAME Attribute Values:
Flags: Archive
Name: TestFile235281024.tst
Parent MFT Entry: 78985  Sequence: 8
Allocated Size: 235282432    Actual Size: 0
Created:       2019-09-03 09:14:18.591216000 (UTC)
File Modified: 2019-09-03 09:14:18.591216000 (UTC)
MFT Modified:  2019-09-03 09:14:18.591216000 (UTC)
Accessed:      2019-09-03 09:14:18.591216000 (UTC)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 108
Type: $DATA (128-1) Name: N/A Non-Resident size: 235281024 init_size: 235281024
3959582 3959583 3959584 3959585 3959586 3959587 3959588 3959589 
...
4017014 4017015 4017016 4017017 4017018 4017019 4017020 4017021 
4017022 4017023 

NTFS Timestamp<span style="letter-spacing:-2px">s|</span>

Qwerty uiop asd fghjkl zxcvb nm. SHA1 C:\TestFolder\TestFile4095.tst 4c1732511805221435db376b8cbad7d0debf72cf MFT Entry Header Values...