Windows MACB Timestamps (NTFS Forensics).