NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
File System Metadata Analysis
Master file system metadata analysis. Learn to detect timestomping, parse MACB timestamps, uncover Alternate Data Streams (ADS), and analyze the USN Journal.
Room tasks
1What Is File Metadata and Why Does It Matter
2Timestamps: Created, Modified, Accessed
3Alternate Data Streams (NTFS)
4Guided Lab: Extracting Metadata Evidence
Frequently Asked Questions
What are MACB timestamps?
MACB stands for Modified, Accessed, Changed and Born (created). Together they describe a file's life and help investigators build timelines of activity on a system.
What are NTFS alternate data streams?
Alternate data streams let a file carry hidden extra data attached to its name. Attackers use them to conceal payloads, so forensic tools check for unexpected streams.
How do investigators spot altered timestamps?
They compare attributes in the MFT and cross-check logs and journals for inconsistencies. This free intermediate Codelivly room teaches those checks hands-on.