Digital Forensics · 5 min
File Systems & Metadata
What file records tell you — and what they never will
This lesson explains the concept, then checks your understanding in a short interactive exercise.
What a file record holds
A file system stores the file's contents plus a record about it: its name, its location in the directory tree, its size and a set of timestamps. That record is metadata — data about the data.
- Path and filename: where it sits and what it claims to be
- Size: useful for spotting truncation or unexpected growth
- Timestamps: when the file system recorded particular kinds of change
Timestamps, carefully
Most file systems track several timestamps — commonly a creation time, a modification time and an access time — but exactly which are kept, and how precisely, depends on the file system and its configuration.
- Modified: content changed, by any process — not necessarily a person
- Accessed: often unreliable, and updates may be reduced or disabled for performance
- Created: on a copy this can reflect the copy operation, not the original authoring
- Timestamps can also be set deliberately by software to arbitrary values
Loading the interactive lesson…