Hi,
Is there a way to add custom columns with the timestamps of the last MFT change of any file of folder ? Like the columns for created, modified and accessed timestamps. Because the timestamp for last MFT change is an attribute present in the MFT for every file, like the 3 others timestamps. So I think it is easy to get this information for any file/folder. These 4 timestamps are in the attribute $STANDARD_INFORMATION (0x10) in MFT, and for MFT last change timestamp it is called M Time I Think.
I don’t know how to to this via script addins, if possible.
Also in the same fashion I would like to have columns that display the same 4 timestamps (created, modified, accessed and MFT changed) but for just the hardlinks themselves. Because in NTFS every filename (hardlink) for a particular file also store individually those 4 timestamps, and they are often different from the core timestamps of the file. They are updated on each hardlink basis. For example if you rename one particular hardlink or modify a file from it, only the timestamp of this hardlink (and the core ones) will be changed and not the ones on the others hardlinks of the file. Those hardlink timestamps are written in the attributes $FILE_NAME (0x30) in MFT for any file.
Because there can be several hardlinks thus several $filename attributes per file, those columns should display the timestamps only for the displayed hardlink on it’s line on the file list. So for each hardlink the script should consider only the $filename attribute with the same parent folder as the one open for the list. The parent folder of each hardlink/filename is indicated also in the $filename attribute by his reference.
I don’t know enough about scripting yet to be able to implement all these things.