windows-time-rules.md

layout	permalink
default	/windows-time-rules

Windows Time Rules

$STDINFO

{:.table-bordered}

File Rename	Local File Move	Volume File Move	File Copy	File Access	File Modify	File Creation	File Deletion
Modified	Modified	Modified	Modified	Modified	Modified	Modified	Modified
Access	Access	Access	Access	Access No Change on Vista/Win7	Access	Access	Access
Creation	Creation	Creation	Creation	Creation	Creation	Creation	Creation
Metadata	Metadata	Metadata	Metadata	Metadata	Metadata	Metadata	Metadata

Bold = modified

$FILENAME

{:.table-bordered}

File Rename	Local File Move	Volume File Move	File Copy	File Access	File Modify	File Creation	File Deletion
Modified	Modified	Modified	Modified	Modified	Access	Modified	Modified
Access	Access	Access	Access	Access	Access	Access	Access
Creation	Creation	Creation	Creation	Creation	Creation	Creation	Creation
Metadata	Metadata	Metadata	Metadata	Metadata	Metadata	Metadata	Metadata

Bold = modified

Sources

• https://digital-forensics.sans.org/media/poster-windows-forensics-2016.pdf