NTFS Time

NTFS records the meta-data about each file on the system in the Master File Table (MFT). The MFT is held in the system file $MFT. For each file record in the MFT there is usually a $STANDARD_INFORMATION attribute and a $FILE_INFORMATION attribute. Each of these attributes contain no less than 4 NTFS times (created, accessed, MFT modified and last written times).

It is important to note that unlike FAT times, NTFS times are recorded in UTC rather than local time.

NTFS times are an 8 byte integer number recording the number of 100 nanosecond (10-7) 'ticks' since 1601-01-01 00:00:00.0000000 (UTC).