Custom columns for MFT changed timestamps, and for individual hardlinks timestamps?


Is there a way to add custom columns with the timestamps of the last MFT change of any file of folder ? Like the columns for created, modified and accessed timestamps. Because the timestamp for last MFT change is an attribute present in the MFT for every file, like the 3 others timestamps. So I think it is easy to get this information for any file/folder. These 4 timestamps are in the attribute $STANDARD_INFORMATION (0x10) in MFT, and for MFT last change timestamp it is called M Time I Think.

I don’t know how to to this via script addins, if possible.

Also in the same fashion I would like to have columns that display the same 4 timestamps (created, modified, accessed and MFT changed) but for just the hardlinks themselves. Because in NTFS every filename (hardlink) for a particular file also store individually those 4 timestamps, and they are often different from the core timestamps of the file. They are updated on each hardlink basis. For example if you rename one particular hardlink or modify a file from it, only the timestamp of this hardlink (and the core ones) will be changed and not the ones on the others hardlinks of the file. Those hardlink timestamps are written in the attributes $FILE_NAME (0x30) in MFT for any file.

Because there can be several hardlinks thus several $filename attributes per file, those columns should display the timestamps only for the displayed hardlink on it’s line on the file list. So for each hardlink the script should consider only the $filename attribute with the same parent folder as the one open for the list. The parent folder of each hardlink/filename is indicated also in the $filename attribute by his reference.

I don’t know enough about scripting yet to be able to implement all these things.

Scripts can add columns very easily. I don't know if there is a way for scripts to access that information from Windows, though; it's not something I've ever looked into.

Thanks for reply.

Yes, scripting seems to be a very powerfull way to implement many new things, I must learn how to use it conveniently.

But for the timestamps columns, how DOpus is already accessing informations for the regular ones (created, modified, accessed)? Isn't it just possible to use the same columns's codes and change just the timestamp type? Or is it something restricted by Windows ? I think not because some programs can access all MFT timestamps easily for core files and hardlinks, like Autopsy, but it is not a file manager.

I would like to be abble to see all those timestamps in realtime for any file like any others NTFS attributes. Should we use some shell extension to have those columns ?