Read an NTFS $MFT, and catch the dates that were rewritten MFT
Every NTFS file keeps two sets of dates: the ones Windows shows and a program can change, and the ones the kernel writes and almost nothing exposes. When they disagree, the file was timestomped.
1. The table
A $MFT extracted from an NTFS volume. It is read here and never written to, and nothing is uploaded.
No file open yet.
2. What it describes
How it works
Reading the two sets of dates
The columns show the $STANDARD_INFORMATION times, the ones Explorer shows and a program can set. A highlighted row is one where those disagree with the $FILE_NAME times the kernel wrote - the shown creation date is earlier than the name existed, or its sub-second precision was wiped. That is the shape of timestomping. It is a lead, not a verdict: corroborate against the change journal, the registry and the event logs, and remember a wrong clock skews every date together. Hash the copy with CHECKSUM and note its source with CHAIN first.
Doing this often? The Sovereign Console loads disk images and Windows artefacts into one case, and puts every timestamp on one timeline. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.