Ever wonder which IOCTLs result in timestamp updates under Microsoft operating systems? via Troy/ntevidence http://download.microsoft.com/download/4/3/8/43889780-8d45-4b2e-9d3a-c696a890309f/File%20System%20Behavior%20Overview.pdf