Glossary
MACB Timestamps
The four NTFS file times — Modified, Accessed, Changed (MFT entry), and Born (created) — used to build forensic timelines.
MACB is a shorthand for the four timestamps NTFS keeps for every file: Modified (content last written), Accessed (last read), Changed (the MFT entry itself was updated, e.g. permissions or name), and Born (file created). Together they let investigators reconstruct when a file appeared, was used, and was altered.
Each file actually carries two sets of these times. The $STANDARD_INFORMATION attribute holds the values shown by Windows and easily modified by user-mode tools, while $FILE_NAME holds a copy that is normally only updated by the kernel. Comparing the two sets is a core technique for spotting tampering, because anti-forensic tools often rewrite only $STANDARD_INFORMATION.
M = Modified (content change)
A = Accessed (last read)
C = Changed (MFT metadata change)
B = Born (creation)
See also Timestomping and Master File Table (MFT).