Time shown in IW29

Hi all,

I have question which probably have been asked before. When getting data from IW29, one gets several time stamp information:

1. Notification Time
2. Created at, and
3. Malfunction start

What is the difference between those time stamp. What I know is that malfunction start can be changed by user.

My second question:

Is there a time stamp which recorded by SAP the very first time when a notification is created and cannot be changed?

and my third:

If the answer to my second question is yes, will the data change whenever someone change the data in a notification? I mean is it the same as Last Change Time?

Thank you in advance and I hope I explain my question clearly.