- NTFS maintains three independent audit trails: MFT ($STANDARD_INFORMATION and $FILE_NAME), USN Journal, and $LogFile, each capturing different granularity and retention.
- The $FILE_NAME timestamps in the MFT are kernel-written and cannot be modified via standard APIs, making divergence from $SI a reliable indicator of timestomping.
- The USN Journal logs all file system changes sequentially, survives file deletion, and typically retains about 20 days of activity on active volumes.
- The $LogFile is a low-level transaction log providing independent evidence of when NTFS attributes were last written, useful for confirming manipulation.
- dfir_ntfs (Python library) and MFTECmd (CSV output) are complementary tools: dfir_ntfs provides programmatic access to raw NTFS structures, while MFTECmd produces analyst-ready output.
- File carving is a last resort when MFT metadata is corrupted or missing, but it lacks provenance and timeline context.
- Correlating all three artefact layers (MFT, USN Journal, $LogFile) produces a more robust timeline than any single source.
- A practical investigation workflow starts with $MFT extraction, then USN journal analysis, then $LogFile cross-referencing, and volume shadow copies for recovery.