Skip to content
$LogFileparser

Glossary

$STANDARD_INFORMATION ($SI)

The NTFS attribute (type 0x10) holding a file's main timestamps, flags and security and USN fields; the set that timestomping tools usually rewrite.

$STANDARD_INFORMATION ($SI, attribute type 0x10) is normally the first attribute of every FILE record. It holds four FILETIME timestamps — created, modified, MFT entry changed, last accessed — plus file attribute flags and, on NTFS 3.x, owner, security and update sequence number fields.

These are the times Explorer shows and the ones applications can change with SetFileTime, which is why timestomping targets them. In $LogFile, changes to $SI appear as UpdateResidentValue records with the old values in the undo bytes and the new ones in the redo bytes. Compare with $FILE_NAME and see detecting timestomping with the $LogFile.