How can I display all 8 NTFS timestamps?



NTFS (New Technology File System) is a high-performance file system developed by Microsoft for use on Windows operating systems. It is the default file system of Windows NT and its successors, including Windows 2000, Windows XP, Windows Vista, Windows 7, Windows 8, and Windows 10.

NTFS is a journaling file system, meaning that it keeps track of all changes made to the file system. It does this by recording all changes in a transaction log, which can be used to restore the file system to a consistent state in the event of corruption or system failure. In addition to this, NTFS also keeps track of eight different timestamps for each file and folder. These timestamps are:

• Creation Time – the time when the file or folder was created
• Modification Time – the last time the file or folder was modified
• Last Accessed Time – the last time the file or folder was accessed
• Last Written Time – the last time the file or folder was written to
• Change Time – the last time the file or folder's attributes were changed
• File Attributes Time – the last time the file or folder's attributes were set
• Security Descriptor Time – the last time the file or folder's security descriptor was set
• Backup Time – the last time the file or folder was backed up

These timestamps are valuable for tracking changes to files and folders, as well as for monitoring user activity. However, the default Windows Explorer view only displays the Creation Time, Modification Time, and Last Accessed Time, leaving the other five timestamps hidden.

Fortunately, there are a variety of ways to display all eight NTFS timestamps. Firstly, the Windows command line utility, “dir”, can be used. This utility can be used to display detailed information about files and folders, including all eight of the NTFS timestamps. To view the timestamps, open a command prompt window and type “dir /T:CX” followed by the name of the file or folder in question. This will display the Creation Time, Modification Time, Last Accessed Time, Change Time, File Attributes Time, and Security Descriptor Time.

Another option is to use a third-party utility. There are several utilities available that can be used to display all eight NTFS timestamps. One example is NTFSInfo, which is a free utility that can be downloaded from the Internet. Once installed, it can be used to view the timestamps for any file or folder.

Finally, the PowerShell scripting language can be used to display the timestamps. PowerShell has a built-in cmdlet, “Get-NTFSTimestamps”, which can be used to display all eight of the NTFS timestamps. To use it, open a PowerShell window and type “Get-NTFSTimestamps ”, where is the name of the file or folder you want to view.

In summary, there are several ways to display all eight NTFS timestamps. The Windows command line utility, “dir”, can be used. Third-party utilities such as NTFSInfo can be used. And PowerShell can be used with the “Get-NTFSTimestamps” cmdlet. All of these methods allow IT administrators to view detailed information about files and folders, including all eight of the NTFS timestamps.

Inquire Now

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Find your next full or part-time role here

ScaleDesk can either help you find your next full time gig or a part time side gig where you can create extra income!

Onboard with us once
Skip HR screening and go to the final interview with with only your resume and a video interview you never have to redo
Get paid electronically every month for the hours you work
We will be your reference even if you work for us once

IT Teams: Use ScaleDesk to augment your team

Schedule Demo