Which File System Stores MAC Timestamps in UTC?
Short answer
B NTFS is the file system that stores MAC attributes in Coordinated Universal Time (UTC) format.
Question
Key Takeaways
The question tests knowledge of how file systems encode MAC timestamps, and the common trap is confusing NTFS (Windows, UTC) with HFS (Mac) based on platform association rather than timestamp format.
MAC (Modified, Accessed, Created) timestamps are stored differently depending on the file system, and forensic examiners must know which ones are recorded in Coordinated Universal Time (UTC). This page establishes that NTFS stores its MAC attributes in UTC, while FAT stores them in local time, making option B the correct answer.
Common mistake: The most common wrong choice is C (HFS), because learners associate Mac file systems with the 'MAC attributes' wording or assume all modern file systems use UTC — but classic HFS records local-time values, while NTFS is the canonical UTC-storing system cited in forensic literature.
Expert Analysis
Why the Answer Is Correct
NTFS stores the MAC (MFT Entry Modified, Accessed, Created) attribute timestamps in UTC using 100-nanosecond intervals since January 1, 1601, which is why Windows converts them to local time only for display. As commenter Elb noted, "The NTFS file system stores time values in UTC format", and this UTC baseline is what allows forensic examiners to correlate NTFS timestamps with other evidence without timezone drift. Since UTC storage preserves a single unambiguous reference point across systems, NTFS is the standard answer for this objective.
Why the Other Options Are Wrong
FAT (option A) stores creation, modification, and access times in local time with only two-second granularity on modification time, so it does not satisfy the UTC requirement. HFS (option C) uses the classic Mac epoch of January 1, 1904 and historically records local time rather than UTC, so the reasoning that 'HFS is for Mac' does not make it correct; as aqeel1506 wrote, "NTFS is for WIndows, HFS is for MAC" — but platform ownership is irrelevant to the timestamp format question. Global File System (GFS, option D) is a Linux cluster file system that is not the canonical answer taught for UTC-based MAC storage in this curriculum.
Community Comment Notes
Comments split between B and C: Elb correctly reinforces that NTFS stores time values in UTC, while aqeel1506 first notes the platform association "NTFS is for WIndows, HFS is for MAC" and later asserts "answer is C". The platform-association reasoning does not address the UTC storage format, so the later C assertion is unsupported; the NTFS/UTC alignment with exam doctrine makes B the defensible verdict.
Exam Strategy
When a question ties a technical attribute (like timestamp format) to file systems, ignore platform branding (Windows vs. Mac) and recall the encoding detail: NTFS = UTC, FAT = local time. Read every option's storage format before selecting, since association-based distractors are deliberately designed to mislead.
Frequently Asked Questions
Why isn't HFS the correct answer for UTC MAC timestamps?
Does FAT store MAC timestamps in UTC?
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Elb 👍 1The NTFS file system stores time values in UTC format,
-
aqeel1506 👍 1NTFS is for WIndows , HFS is for MAC
-
aqeel1506 👍 1answer is C
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.