MACB Times are four forensic file timestamps: modified, accessed, changed, and born. They describe when file content, metadata, access, or creation-related state changed, and investigators use them to reconstruct file activity and detect tampering or anomalous chronology.
What MACB Times Reveal in a Forensic Examination
MACB timestamps are more than metadata fields. They let an investigator compare when a file was created, modified, accessed, or had its metadata changed, which can expose activity that ordinary file listings hide. Interpreting them correctly requires understanding what each timestamp can and cannot prove, especially when a system or attacker has altered the chronology.
How Modified, Accessed, Changed, and Born Differ
Each MACB timestamp captures a different event class. Modified reflects content changes, accessed reflects last read activity, changed reflects metadata or status updates, and born reflects creation-related origin information where the file system preserves it. Because these timestamps are updated by different operations, they often diverge, and that divergence is often the first clue that a file has been copied, edited, renamed, or staged across environments.
Investigators treat the four values as a timeline, not as a single truth source. A file can be opened without content changes, metadata can change without a visible edit, and some file systems preserve birth time while others do not. That means MACB analysis is strongest when it is combined with the surrounding file system context, volume metadata, and other artefacts that confirm whether the timestamps are trustworthy.
Why MACB Chronology Matters in Incident Investigation
MACB times help establish sequence: what existed first, what was altered later, and what was merely viewed. That makes them useful for spotting staging, tampering, backdating, and unusual operator activity. For example, a file whose modified time is newer than its apparent creation sequence, or whose access pattern does not fit user activity, may warrant a closer look.
They are also valuable because a file timestamp can be manipulated more easily than many investigators expect. Time-shifting tools, copy operations, timezone confusion, and file system differences can all produce misleading chronology. A sound investigation therefore treats MACB as evidentiary support, not as standalone proof.
Common Limits and Validation Pitfalls
MACB interpretation depends on the operating system, file system, and tooling used to collect the evidence. Not every platform preserves all four timestamps equally, and some activity updates only metadata rather than file content. That creates false confidence if investigators assume a timestamp necessarily means a human opened, edited, or created the file in the ordinary sense.
Validation usually means checking whether the timestamps are internally consistent, whether they match surrounding event logs, and whether the collection method could have changed them. A disciplined review compares the file’s chronology with directory entries, $MFT or equivalent artefacts, and user or process activity so the timestamp story is supported by more than one source.
Risk and Threat Considerations
MACB timestamps are attractive to defenders because they can reveal tampering, but they are also attractive to attackers because they can be altered, obscured, or made to look routine. That creates a forensic risk: a manipulated chronology can mislead triage, hide the real order of execution, or make suspicious file activity appear older or less relevant than it is.
Failure mechanism: Adversaries and post-compromise tools may change file metadata, copy artefacts between locations, or rely on file system behavior that weakens timestamp reliability, producing a chronology that no longer reflects the true sequence of activity.
Impact: Investigators may mis-rank evidence, miss the initial intrusion window, or accept a compromised file timeline as authentic, which can delay containment and weaken attribution of malicious activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Forensic timestamp analysis depends on correlating file chronology with audit evidence. |
| SI-4 — System Monitoring | Monitoring helps detect suspicious file changes and chronology manipulation around evidence files. | |
| CM-6 — Configuration Settings | File system and platform settings influence how reliably timestamps are preserved and interpreted. | |
| Recommendation — Correlate timestamp anomalies with audit records to reconstruct file activity and confirm the sequence of events. Monitor file and process activity to detect tampering patterns that can distort forensic timelines. Validate and standardize system settings that affect timestamp preservation and evidence collection. | ||
| MITRE ATT&CK | T1070.006 — Timestomp | Timestamp manipulation is a recognised adversary technique that directly affects MACB chronology. |
| Recommendation — Map timestamp anomalies to T1070.006 and hunt for evidence of chronology manipulation. | ||
| NIST CSF 2.0 | DE.CM-01 — The organization monitors networks and systems to detect potentially adverse events | MACB analysis supports detection of suspicious file activity and timeline irregularities. |
| DE.AE-02 — Potentially adverse events are analyzed to better understand associated events | MACB timestamps are analyzed to understand suspicious file events and their sequence. | |
| Recommendation — Use file chronology as part of system monitoring to identify potentially adverse events. Analyze anomalous file timelines to determine what happened and when it likely occurred. | ||
Practitioner Guidance
What to watch for: Treat MACB as a reconstruction aid, not a verdict. When the timestamps look unusual, test them against surrounding artefacts before drawing conclusions, especially if the evidence may have moved across operating systems or file systems.
Practitioner note: The most reliable timestamp story is the one that can be independently corroborated. Use MACB to frame the investigation, then confirm the sequence with logs, directory metadata, and process evidence before relying on it in reporting or legal workflows.
Related resources from NHI Mgmt Group
- Why do C3PAO lead times matter as much as control implementation?
- Why does endpoint coverage matter so much for MSSP response times?
- How do you know if your SOC can still keep up with breakout times measured in minutes?
- What breaks when SOC data retention is too short for modern intrusion dwell times?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org