Sparta Defend Research

Research

What we measure about Windows while building endpoint protection for it. We publish the behaviour of the platform, with the method and the numbers, so anyone can check it. We do not publish how our detection works.

1 NOVEMBER 2026Windows internalsNTFSRansomwareDFIR

Encrypted, but never modified: memory-mapped writes leave NTFS timestamps untouched

Rewriting a file through a memory-mapped view on Windows does not update its last-write or change time. We measured it against a control group, showed what it means for ransomware investigations, and found a way to recognise it after the fact in the USN change journal.

READ THE RESEARCH →