$STANDARD_INFORMATION vs $FILE_NAME

Every file record in the $MFT carries two independent sets of MACB timestamps: one in the $STANDARD_INFORMATION attribute (often shortened to $SI) and one in each $FILE_NAME attribute ($FN). Both use the FILETIME format in UTC.

The difference lies in who updates them. $SI holds the times that Explorer, dir and most APIs display, and a user-mode program can rewrite them with a standard call such as SetFileTime. $FN times are maintained by the file system driver and change mainly when a file is created, renamed or moved; normal applications have no direct API to set them. A file can also have more than one $FN attribute, for example a long name and a short 8.3 name.

That asymmetry makes the comparison valuable:

• An $SI creation time earlier than the $FN creation time is a classic sign of timestomping.
• $SI values with a zero sub-second part, while $FN values carry full precision, point the same way.
• Because $FN often reflects when a file arrived in its current location, it can help date copies and moves.

Treat these as indicators, not proof. Legitimate operations such as extracting archives or some installers can also set older $SI times, and tools with kernel access can alter $FN too. Corroborate with the $UsnJrnl and other sources.