# File System Metadata Analysis

> Master file system metadata analysis. Learn to detect timestomping, parse MACB timestamps, uncover Alternate Data Streams (ADS), and analyze the USN Journal.

Canonical: https://codelivly.com/rooms/file-system-metadata-analysis
Last updated: 2026-09-12

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This module dives deep into the hidden metadata of file systems, focusing primarily on NTFS architectures. You will learn to analyze MACB (Modified, Accessed, Created, Birth) timestamps, detect anti-forensic "timestomping" by comparing $STANDARD_INFORMATION and $FILE_NAME attributes, uncover hidden payloads in Alternate Data Streams (ADS), and parse the Windows USN Journal ($UsnJrnl) to reconstruct precise file activity timelines. From a cybersecurity perspective, mastering metadata analysis is critical for exposing attacker cover-up attempts, identifying concealed malware, and building legally defensible, accurate event timelines.

## Lessons

1. What Is File Metadata and Why Does It Matter (30 min)
2. Timestamps: Created, Modified, Accessed (30 min)
3. Alternate Data Streams (NTFS) (30 min)
4. Guided Lab: Extracting Metadata Evidence (30 min)

## Related

- [Learning path: Disk and File System Forensics](https://codelivly.com/learning-paths/disk-and-file-system-forensics)
- [All rooms](https://codelivly.com/rooms)