Entry Modified, in EnCase, refers to when the MFT entry for that file was last change. As the MFT entry contains a lot of information about the file, including, size, name, location on the disk, parent folder, creation date, etc, changing any one of these should also change the “Entry Modified” date. E.g renaming the file, moving the file (defragmenting – moving it on the disk, or moving it into a different folder), or increasing the file size.
Under normal circumstances any action that trips any of the other dates, created, accessed, or file modified (referred to as Last Written in EnCase), will also trip the Entry Modified date – this is due to one of two reasons:
The action that tripped the date, e.g. renaming the file caused a change in the MFT so the Entry Modified date will be updated
Altering any of the file dates will, by definiiton, change the MFT Entry (as this is where the dates are stored). Therefore the MFT Entry is changed.