Digital Forensics Chain-of-Custody Hash Manifest & MACB Timeline Builder (2026)

MACB represents the four core file system timestamps: **M**odified (when file content bytes were last written), **A**ccessed (when file data was last read or touched), **C**hanged / MFT Entry Modified (when metadata such as permissions, filename, or attributes changed), and **B**orn / Created (when the file record was originally created on that volume).

Every file in an NTFS Master File Table (`$MFT`) stores two separate sets of MACB timestamps: one inside the `$STANDARD_INFORMATION` (`$SI`) attribute and another inside the `$FILE_NAME` (`$FN`) attribute. User-mode Windows APIs like `NtSetInformationFile` and `SetFileTime` (used by malware timestompers) can easily overwrite `$SI`, but `$FN` can only be modified by the Windows kernel itself. If `$SI Created` is 2021-01-01 while `$FN Created` is 2026-09-28, timestomping is proven.

When you copy an existing file to a new volume or folder on Windows, the OS preserves the original content's `Last Write (Modified)` timestamp from months or years ago, but assigns the current clock time as the new file's `Created (Born)` timestamp on the destination volume. That makes the file appear 'modified before it was born'—a classic forensic indicator that a file was copied rather than created locally.

NTFS stores timestamps in 64-bit FILETIME intervals of 100 nanoseconds (7 decimal places, e.g., `.4829103`). Older timestomping tools or manual scripts that pass second-level or millisecond-level timestamps leave the trailing fractional ticks as `.0000000`, which has a 1-in-10,000,000 chance of occurring naturally.

No. Hashing uses your browser's hardware-accelerated `crypto.subtle.digest()` API directly on local `ArrayBuffer` slices. Zero bytes of evidence leave your workstation.