In the article the papers concerning identification of patterns for timestamps variation during file operations being performed are observed. The authors suggest a unique method files timestamps experimental investigation. The obtained research results are summarized in a table that clearly shows the changes in time stamps when the user performs operations over files. Systematized data in the form of a table can be the basis for the development of a method for restoring a sequence of file operations that is suitable for automation.