I understand NTFS file timestamp metadata includes the following:
- Created
- Accessed
- Modified
This data is accessible in the Windows Explorer UI and elsewhere.
However, I believe the timestamp metadata includes
- Changed
Apparently the Changed timestamp is when the file's master file table entry was changed (see https://app.pluralsight.com/library/courses/digital-forensics-file-systems-getting-started/).
How can I get access to this value?