Skilled attackers often modify file timestamps and clear logs, but NTFS retains a layered audit trail across multiple structures. The Master File Table ($MFT), USN Journal, and $Log File each capture different dimensions of file system activity. Understanding and correlating these artefacts significantly enhances investigations.

NTFS stores file metadata in at least two locations per file: $STANDARD_INFORMATION and $FILE_NAME within the $MFT. Attackers can often alter $STANDARD_INFORMATION timestamps using standard APIs while leaving the kernel-written $FILE_NAME timestamps untouched, creating a detectable discrepancy. The USN Journal logs every file system change sequentially and survives file deletion, typically retaining around 20 days of activity.

Tools like dfir_ntfs and MFTECmd aid in extracting and correlating these artefacts. dfir_ntfs provides programmatic access to raw NTFS structures, while MFTECmd offers analyst-ready CSV output for timeline analysis. Correlating timestamps from the $MFT, USN Journal, and $Log File provides a more robust and harder-to-suppress investigative narrative than any single source alone.