MFT and Shimcache Executable Timestamp Comparison

By extracting and comparing timestamps from MFT and Shimcache, it is possible to identify inconsistencies that could represent timestomping in relation to executable files.

The Application Compatibility Cache (referred to as Shimcache) records a value for the Last Modified Time when an executable file is last run. The Master File Table (MFT) contains information about every file and directory on an NTFS volume. Each file or directory is represented by an MFT entry, which stores metadata about the file, including modified, accessed, and created timestamps.

If the Shimcache timestamp indicates a file was run at a certain time but the MFT shows a different or much later modification timestamp, this would be considered unexpected.