What forensic indicator suggests that a file's timestamps have been tampered with in an NTFS system?

If the MFTChangeTime attribute is later than the CreateTime, AccessTime, and LastWriteTime, it is a strong indicator of tampering. Since MFTChangeTime updates when any file attribute changes but is not commonly modified by standard tools, an anomaly like this suggests an attacker manually altered timestamps.

---
**Related reading:**
- Penetration Techniques - Time Attributes of NTFS Files in Windows — original article
- Zimbra SOAP API Development Guide
- Unauthorized file copying via COM component IFileOperation
- Setting Up ADAudit Plus Vulnerability Debugging Environment