A forensic examiner is analyzing a disk image and wants to identify all files that were accessed within a specific time window. Which NTFS metadata field records the last access time?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — the $STANDARD_INFORMATION $ATIME (Last Access Time) field is the one you want because NTFS stores last access in $ATIME, which records when file content was last read. The modified-time field only tells you when content changed, not when it was accessed.
Full Explanation
The $STANDARD_INFORMATION $ATIME (Last Access Time) field is correct because the NTFS $STANDARD_INFORMATION attribute contains four timestamps: $CRTIME (created), $MTIME (modified), $CTIME (MFT entry changed), and $ATIME (last accessed). $ATIME records when the file content was last read, making it relevant for identifying files accessed within a specific time window. The $STANDARD_INFORMATION $MTIME (Modified Time) field is wrong because it records the last time file content was modified, not accessed. The $FILE_NAME $CRTIME (Creation Time) field is wrong because it records the file's creation timestamp within the $FILE_NAME attribute, which is harder to manipulate than $STANDARD_INFORMATION timestamps, but it does not record last access. The $BITMAP attribute tracking cluster allocation is wrong because $BITMAP tracks which clusters are allocated but does not contain file access timestamps.