CompTIA Security+ (SY0-701)Security OperationsHard
During a forensic examination of an NTFS file system, an investigator needs to determine the exact time the contents of a specific file were last altered, as opposed to when the file was merely opened or when its metadata record was updated. Which timestamp within the file's MAC(E) times should the investigator rely on?
- AAccessed (A) time
- BEntry Modified / MFT change time
- CModified (M) time
- DCreated (C) time
Show answer & explanationAnswer & explanation
Correct answer: C. Modified (M) time
The Modified (M) timestamp records when the actual content of a file was last changed, making it the correct indicator of content alteration. Accessed time only reflects when the file was opened or read, Created time reflects when the file was first created, and the Entry Modified/MFT change time reflects changes to the file's metadata record, not its content.
Why the other options are wrong
- A. Accessed time only shows when the file was opened or read, not content changes.
- B. Entry Modified/MFT change time reflects metadata record changes, not content edits.
- D. Created time reflects the original creation date, not later content edits.
MAC(E) Timestamps
File system metadata timestamps—Modified, Accessed, Created, and (on NTFS) Entry Modified—used by forensic examiners to reconstruct file activity timelines.
- Modified = content was changed
- Accessed = file was opened/read
- Created = file was first created
- Entry Modified (NTFS) = MFT metadata record changed
Memory trick: MACE: Modified=content edited, Accessed=file opened, Created=born, Entry=paperwork updated.