Hello Reader,
In yesterdays blog we went through the USN entries for the creation, modification and deletion of a single text file located within the users documents directory on a Windows 7 system. Our conclusions showed we couldn't rely on the USN Journal to show the creation or deletion times of the file without additional analysis. In this post I'm going to run through the locations within the other standard artifacts where you could obtain this information.
Please Note: This post is not for the analysis of those temporary files accessed within Outlook, we will have a separate post about that tomorrow.
So let's run down our other standard artifact locations and see what they reveal.
So if we rely on the creation time stamp here we would see that it lines up with our first file_create reason code from the USN Journal letting us know that was indeed the creation time of the file.
In yesterdays blog we went through the USN entries for the creation, modification and deletion of a single text file located within the users documents directory on a Windows 7 system. Our conclusions showed we couldn't rely on the USN Journal to show the creation or deletion times of the file without additional analysis. In this post I'm going to run through the locations within the other standard artifacts where you could obtain this information.
Please Note: This post is not for the analysis of those temporary files accessed within Outlook, we will have a separate post about that tomorrow.
So let's run down our other standard artifact locations and see what they reveal.
NTUSER Registry
The NTUSER registry has a couple dates for us showing when the file was opened:OpenSavePidlMRU\*This is information you should expect to see populated and contains the last time the file was opened.
LastWrite Time: Tue Dec 10 16:17:51 2013
Note: All value names are listed in MRUListEx order.
Users\test.txt
RecentDocs
**All values printed in MRUList\MRUListEx order.
Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
LastWrite Time Tue Dec 10 16:17:51 2013 (UTC)
22 = test.txt
Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.txt
LastWrite Time Tue Dec 10 16:17:51 2013 (UTC)
MRUListEx = 1,0
1 = test.txt
Jumplists
The Jumplist for notepad does contain a MRU date and time for this file when it was last opened:MRU/MFU stream# MRU date MRU-UTCThis lines up with our known times of last open from the NTUSER Registry. What is interesting with this jumplist entry is that there were no target file dates captured. Meaning that the creation, modification and access times of the file were not contained within the Jumplist for notepad.
1 3 12/10/2013 16:17:51.083
LNK Files
The LNK file in this case shows the first sign of the creation and modification times of the file here.
So if we rely on the creation time stamp here we would see that it lines up with our first file_create reason code from the USN Journal letting us know that was indeed the creation time of the file.
$MFT
Since this file was deleted before defrag ran again, scheduled to run by default every Wednesday at 2am on Windows 7, we can still find its information within the MFT.
In this case the standard information mod time and MFT mod time are the same. So this does not reflect the true deletion time that occurred at 8:47PM as we know from the USN and my testing timeline.
So at this point we've confirmed the creation time of the file and the last open time of the file through an application. Tomorrow let's go through the $logfile and talk about absolute deletion dates.
