A forensic examiner is analyzing a disk image and wants to identify all files that were accessed within a specific time window. Which NTFS metadata field records the last access time?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because NTFS $STANDARD_INFORMATION attribute contains four timestamps: $CRTIME (created), $MTIME (modified), $CTIME (MFT entry changed), and $ATIME (last accessed); $ATIME records when the file content was last read, making it relevant for identifying accessed files. A is wrong because $MTIME records the last time file content was modified, not accessed.
Full explanation below image
Full Explanation
B is correct because NTFS $STANDARD_INFORMATION attribute contains four timestamps: $CRTIME (created), $MTIME (modified), $CTIME (MFT entry changed), and $ATIME (last accessed); $ATIME records when the file content was last read, making it relevant for identifying accessed files. A is wrong because $MTIME records the last time file content was modified, not accessed. C is wrong because $FILE_NAME $CRTIME records the file's creation timestamp within the $FILE_NAME attribute (which is harder to manipulate than $STANDARD_INFORMATION timestamps). D is wrong because $BITMAP tracks which clusters are allocated but does not contain file access timestamps.