Ask "when did this happen" about a file, and the honest answer is: which clock do you mean? A file system does not keep one timestamp. It keeps up to four, each answering a different question, and reading the wrong one is a quiet, easy way to get a forensic finding wrong.
The four clocks a file carries
A file system tracks up to four timestamps per file, remembered by the acronym MACB.
| Letter | Meaning | What changes it |
|---|---|---|
| M | Modified | The file's content was last changed |
| A | Accessed | The file was last read, including simply being opened |
| C | Changed | The file's metadata changed, such as a permission edit |
| B | Born (created) | The file first appeared on this file system |
Caution: Opening a file to examine it can itself alter its Accessed time
This is why evidence is copied before it is read, the rule this unit has followed from its very first article. An investigator who opens the original file directly, even just to look, can quietly overwrite the one timestamp that might have told them when a suspect last viewed it. Work from the copy; let the Accessed time on the original stay exactly as it was found.
Reading MACB times
file_times.py
# file_times.py
import os
import datetime
def get_macb_times(path):
s = os.stat(path)
return {
"modified": datetime.datetime.fromtimestamp(s.st_mtime),
"accessed": datetime.datetime.fromtimestamp(s.st_atime),
"changed": datetime.datetime.fromtimestamp(s.st_ctime),
}
for label, value in get_macb_times("evidence_copy/report.pdf").items():
print(f"{label}: {value.isoformat()}")
Sample output
modified: 2026-10-17T20:01:23.018310
accessed: 2026-10-17T20:01:44.447888
changed: 2026-10-17T20:01:23.018310
Three Python attributes, three of the four MACB letters: st_mtime is Modified, st_atime is Accessed, st_ctime is Changed. Notice modified and changed are identical here, because this file's content and its metadata were last touched at the same moment, when it was written; accessed is a little later, from the read this very script just performed. That one detail is worth sitting with: running this script changed the Accessed time it just printed. Run it again and that value moves forward again. This is precisely the trap the caution above warns about, demonstrated on the article's own example.
Python concept: Why there is no st_btime on every system
Born (creation) time is the one MACB letter Python's os.stat does not expose uniformly. Windows tracks it directly; many Linux file systems do not record it at all, or only expose it through extra, file-system-specific calls outside the plain os.stat result. In practice, an investigator treats Modified, Accessed and Changed as reliably available everywhere, and checks for Born time separately when the platform and file system are known to support it.
Choosing the right clock for the question
Each letter answers a different investigative question, and picking the wrong one produces a confident, wrong answer.
"When was this document last edited?"
Modified time. Content changes update it; simply opening and closing the file does not.
"Did anyone look at this file recently?"
Accessed time, read with care: examining the file yourself moves it, so this question can only be answered from a copy taken before your own examination began.
"Was this file's permission or ownership changed?"
Changed time. Content can stay untouched while Changed still moves, which is itself a clue that something about the file, not its content, was altered.
"When did this file first appear here?"
Born time, where the platform and file system support it. A file copied onto a new disk gets a fresh Born time even if its Modified time, carried over from the original, is much older.
Try it yourself: See your own MACB times move
Run get_macb_times() against any file on your own machine, note the three values, open the file in a text editor without saving, close it, and run the function again. Accessed will have moved; Modified and Changed will not have, because nothing about the file's content or metadata actually changed, only the fact that it was read.
Check your understanding
Question 1: What do the four MACB letters stand for, and which one does opening a file to read it change?
Modified, Accessed, Changed, Born. Opening a file to read it changes its Accessed time, even if nothing about the file's content or metadata was altered.
Question 2: An investigator wants to know when a document's content was last edited. Which MACB timestamp answers that, and which one would mislead them if they used it instead?
Modified time answers it directly, since only a content change updates it. Accessed time would mislead them: a file can be opened and read many times without its content ever changing, so a recent Accessed time says nothing about when the content was last edited.
Question 3: Why can a file's Born time be newer than its Modified time?
Born time records when the file first appeared on this particular file system, which happens whenever the file is copied onto a new disk or drive. Its Modified time, by contrast, is carried over from the original file's own history and can be much older than the copy operation that just created it in its new location.
Key takeaway: Key takeaway
A file carries up to four separate clocks, and they answer four different questions. Know which letter answers the question you are actually asking, and remember that examining a file, even just opening it, moves its Accessed time, which is exactly why this unit works from copies.