Which File System Stores MAC Timestamps in UTC?
The MAC attributes are timestamps that refer to a time at which the file was last modified or last accessed or originally created. Which of the following file systems store MAC attributes in Coordinated Universal Time (UTC) format?
Community Insight
The question tests knowledge of how file systems encode MAC timestamps, and the common trap is confusing NTFS (Windows, UTC) with HFS (Mac) based on platform association rather than timestamp format.
MAC (Modified, Accessed, Created) timestamps are stored differently depending on the file system, and forensic examiners must know which ones are recorded in Coordinated Universal Time (UTC). This page establishes that NTFS stores its MAC attributes in UTC, while FAT stores them in local time, making option B the correct answer.
The most common wrong choice is C (HFS), because learners associate Mac file systems with the 'MAC attributes' wording or assume all modern file systems use UTC — but classic HFS records local-time values, while NTFS is the canonical UTC-storing system cited in forensic literature.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
NTFS stores the MAC (MFT Entry Modified, Accessed, Created) attribute timestamps in UTC using 100-nanosecond intervals since January 1, 1601, which is why Windows converts them to local time only for display. As commenter Elb noted, "The NTFS file system stores time values in UTC format", and this UTC baseline is what allows forensic examiners to correlate NTFS timestamps with other evidence without timezone drift. Since UTC storage preserves a single unambiguous reference point across systems, NTFS is the standard answer for this objective.Why the Other Options Are Wrong
FAT (option A) stores creation, modification, and access times in local time with only two-second granularity on modification time, so it does not satisfy the UTC requirement. HFS (option C) uses the classic Mac epoch of January 1, 1904 and historically records local time rather than UTC, so the reasoning that 'HFS is for Mac' does not make it correct; as aqeel1506 wrote, "NTFS is for WIndows, HFS is for MAC" — but platform ownership is irrelevant to the timestamp format question. Global File System (GFS, option D) is a Linux cluster file system that is not the canonical answer taught for UTC-based MAC storage in this curriculum.Community Comment Notes
Comments split between B and C: Elb correctly reinforces that NTFS stores time values in UTC, while aqeel1506 first notes the platform association "NTFS is for WIndows, HFS is for MAC" and later asserts "answer is C". The platform-association reasoning does not address the UTC storage format, so the later C assertion is unsupported; the NTFS/UTC alignment with exam doctrine makes B the defensible verdict.Exam Strategy
When a question ties a technical attribute (like timestamp format) to file systems, ignore platform branding (Windows vs. Mac) and recall the encoding detail: NTFS = UTC, FAT = local time. Read every option's storage format before selecting, since association-based distractors are deliberately designed to mislead.
Frequently Asked Questions
Why isn't HFS the correct answer for UTC MAC timestamps?
Classic HFS records timestamps using the 1904 epoch in local time, not UTC. Platform ownership (Mac vs. Windows) does not determine the timestamp format — NTFS's UTC encoding does.
Does FAT store MAC timestamps in UTC?
No. FAT stores creation, access, and modification times in local time, with only two-second resolution on modification time, which complicates forensic time correlation.