What are the four NTFS file time attributes, and which one cannot be viewed through standard Windows properties?
The four NTFS file time attributes are CreateTime, AccessTime, LastWriteTime, and MFTChangeTime. The first three are visible via right-click Properties, but MFTChangeTime is not directly viewable through standard Windows interface; it can only be read using NtQueryInformationFile or by parsing the NTFS Master File Table.
---
**Related reading:**
- Penetration Techniques - Time Attributes of NTFS Files in Windows — original article
- Zimbra SOAP API Development Guide
- Unauthorized file copying via COM component IFileOperation
- Setting Up ADAudit Plus Vulnerability Debugging Environment
---
**Related reading:**
- Penetration Techniques - Time Attributes of NTFS Files in Windows — original article
- Zimbra SOAP API Development Guide
- Unauthorized file copying via COM component IFileOperation
- Setting Up ADAudit Plus Vulnerability Debugging Environment
NTFSMFTChangeTimeNtQueryInformationFilefile attributesforensics