I agree with, Ed! In my experience, most recent NTFS-formatted external drives don’t ship with a “System Volume Information” folder. Instead, the folder is created when the end-user first plugs the drive into a computer.
So, the creation timestamp of the System Volume Information folder might reflect the time of first use if the drive wasn’t formatted after the fact. Another useful indicator is the absence or presence of factory-loaded software such as the manual, backup tools, etc. If such files are present and match those found on another control drive of the same specs by hash, this might be supporting evidence that the drive was likely not formatted as those files would be wiped during a format, and most end users typically wouldn’t put them back after a format.
As for the creation time of the volume, you can mount the device or its forensic image in X-Ways and sort all the items on the drive chronologically. Alternatively, you can use something along the lines of volumeinfo by grawity which queries the volume creation timestamp for NTFS volumes using the ZwQueryVolumeInformationFile function. I would expect this to produce the same result as what you see in X-Ways.
Finally, here is a quick suggestion to do further testing.
- Procure a brand new drive—preferably same make/model as your suspect drive.
- Plug the drive into your analysis workstation using a write blocker and record everything you see in your DFIR tool. You will likely find that there is no System Volume Information folder on the drive at this stage. The volume creation timestamp you determine here should be the date of manufacture.
- Record the time and plug the drive into your anlaysis workstation without a write blocker and record the changes you see. This should result in the System Volume Information folder being created.
- Record the time, format the drive, plug the formatted drive into your analysis workstation with a write blocker and record what you see.
The above should help explain what you are seeing on the suspect drive. Good luck