During some data assessments on CIFS filesystems I have observed some strange behavior of how HCI deals with system metadata time stamps. System metadata timestamps are the usual timestamps we all know from CIFS and NFS when looking into Windows Explorer or do an ls -la. This is NOT the additional timestamps can be stored with the object itself created and maintained by the creating application, like PDF writer, MS Office apps and DICOM applications, for instance.
Here is a some more information in addition what has been discussed already here in other threads for hopefully better understanding from a single point of view.
I hope this gives more insight into this because it is very important to understand this when it comes to file age profiling.
Also important to know BEFORE starting such an assessment is the following: