NTFS timestamps: Official Microsoft Documentation

It happens that you could hear or read about files recovery procedures, file timeline and the recovering of the timestamps from hard disks, usb sticks and SD flash card attached to a PC rather than to a tablet or inside a mobile phone.

And many are the software packages developed that promise to give answer to these questions.

All these informations are strictly related with the filesystem.

For FAT filesystem there is an Official Microsoft Paper,Microsoft Extensible Firmware Initiative, FAT32 File System Specification, that gives the formulas to apply to the reverse engineering operations devoted to recovery metadata.

But what about NTFS filesystem ?

There is an enormous amount of information about NTFS available on the network, but since that information was usually gathered from black-box analysis, its correctness is doubtful.