The Acorn application guide
MFT Viewer
Six Master File Table (MFT) records refer to a manifesto-named document or shortcut in the public Lone Wolf scenario. Compare the two creation-time sets in the selected Box Sync record. A difference alone does not prove timestamp tampering.
Public training example
Compare file records and their stored timestamps
Example input
- NTFS Master File Table records from a public training corpus.
Result or controls shown
- Parsed NTFS file-record and timestamp views.
View full screen
Enlarge the screenshot to read the source records.
Examination steps
Steps to review in your evaluation
-
Locate the relevant file record and retain enough source context to find it again. Check that similar names are not being treated as the same file.
-
Compare the displayed timestamp sets and stream information. Keep stored values, any display conversion and the source collection's history distinct.
-
Test the proposed sequence against journal, shortcut or other available records. If the interpretation matters to the finding, check the relevant record using a suitable independent method.
Evaluate the workflow
Questions worth bringing to a demonstration
- Can I identify the same file record in the supplied source and explain the timestamp fields being compared?
- Does the demonstration distinguish the source's stored values from any conversion used to display them?
- Would an ordinary copy or application action explain the pattern, and which additional record would help decide?
Related application guides
Start with your requirements
Request an application demo
Tell us the source type and task you want to examine. We can plan a demo using suitable training material. Do not send confidential evidence.