Oleg/Igor — Great job double-checking these results. I haven’t checked them in about 17 months or so. But I would recommend you modify your test baseline to not use “Office Documents” as we state in our courses and online that MS Office doesn’t follow the time rules and is considered an exception. When you open, modify, and save an office document, a new MFT is housing the document. This shows that each time you save an office document it is actually “creating” a new file and discretely modifying the timestamps. In this case, it sets the “creation time == modification time == access time” and backdates the creation time to the original’s creation time. Test it. You will see.
Some advice I tell testers for time:
1. Try to use bare-metal command prompt testing if possible that limits use of GUI application that might create exceptions. Command prompt commands such as “echo”, “copy”, “rename”, “move” are useful to try in testing times.
2. Try both cut-paste and copy from Explorer in addition to “move” and “copy” from the command prompt. Our chart is based on “explorer” copy/moves. I have found that if a file is “moved” via the command line the “created” time will not be inherited and the Access Time and Created Times will always be the same. If the file is moved via Explorer then the created time. MFT change and the modified time will be inherited from the original. The Access time is the only time that will be not == to creation time in this instance.
From my double checking the times today I do make some recommendations for some changes to our charts.
+ $FileName times are all == creation times when a file is created (File copied, File Created, Volume File Move) the local file move doesn’t look like it updates (so we need to change that) — Looks like you also found that out with the exception of the “file modification” which is the result of “office documents.”
+ On a volume file move, the MFT Change time is also inherited. I have to test on a Win7/8 system to see if this is new, but it looks that way for now.
+ Going to switch our public poster to the template we recently updated in class — moving from “no change” and “change” to “Inherited from original” and “Time of Copy/Move/Access” etc to make it more clear as to what is “original” and what is updated.
Really great work. But watch out for those Office Documents. They will really throw time analysis off for you.