Glossary
0xBEEF0004 extension block
The file entry extension block in shell items that adds creation and access times, an NTFS file reference and the long file name.
Extension blocks follow the body of a file entry shell item. The one with signature 0xBEEF0004 is the most useful in forensics: it holds creation and last-access FAT timestamps, the long (Unicode) name, and from version 7 onwards an NTFS MFT file reference.
Its version number (3 on XP, 7 on Vista, 8 on Windows 7/8.0, 9 on 8.1/10, per libfwsi) changes the offsets before the long name and hints at which Windows version wrote the item. Byte-level walkthrough: the shell item format explained.