| M | A | C | B | D* | A* | Type | |
|---|---|---|---|---|---|---|---|
| FAT | X | X | X | wFatDate (16bits) wFatTime (16bits) | |||
| NTFS | X | X | X | X | FILETIME structure Contains a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 | ||
| EXT2/3 | X | X | X | X | Unix EPOCH, a 32-bit value representing the number of seconds that have elapsed since January 1, 1970 | ||
| Ext4 | X | X | X | X | X | Unix EPOCH, a 64-bit value representing the number of nanoseconds that have elapsed since January 1, 1970 | |
| XFS | X | X | X | X | Unix EPOCH, a 64-bit value representing the number of nanoseconds that have elapsed since January 1, 1970 | ||
| HFS+ | X | X | X | X | Mac EPOCH, a 32-bit value number of seconds since midnight, January 1, 1904. The creation date stored in the Volume Header is in local time. | ||
| APFS | X | X | X | X | X | Unix EPOCH, a 64-bit value representing the number of nanoseconds that have elapsed since January 1, 1970 |
D*: Deleted time A*: Added to directory time
References :
- https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofiletime
- https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime
- https://digital-forensics.sans.org/blog/2011/03/14/digital-forensics-understanding-ext4-part-2-timestamps
- https://medium.com/@quoscient/mac-b-timestamps-across-posix-implementations-linux-openbsd-freebsd-1e2d5893e4f
- https://github.com/torvalds/linux/blob/master/fs/ext2/ext2.h
- https://github.com/torvalds/linux/blob/master/fs/ext4/ext4.h
- https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf
- https://developer.apple.com/library/archive/technotes/tn/tn1150.html
- https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_format.h
- https://github.com/log2timeline/dfdatetime/wiki/Date-and-time-values