±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34071
New Yesterday: 1 Visitors: 143

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Copying files to external drives on Mac Vs Windows

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Copying files to external drives on Mac Vs Windows

Post Posted: Tue May 15, 2018 8:08 pm

Essentially, when you copy files from the computer to an external drive -

On Mac - the metadata is preserved
On Windows - the metadata is not preserved

Is this correct?  

wotsits
Senior Member
 
 
  

Re: Copying files to external drives on Mac Vs Windows

Post Posted: Tue May 15, 2018 9:45 pm

No, it isn't correct. It is more complex.

It depends on the file systems in use on each drive. e.g. NTFS to FAT32 or HFS+ to FAT32, or FAT32 to FAT32.

It also depends on the tool used to copy the file. e.g. drag and drop in Windows explorer, xcopy, or some specialised forensic's tool.

Also depends on what you define as metadata. e.g. dates, times, streams, file ownership, encryption, hard links, junctions, fragmentation, slack space, alternative 8.3 names, compression, attributes, etc.....  

Passmark
Senior Member
 
 
  

Re: Copying files to external drives on Mac Vs Windows

Post Posted: Wed May 16, 2018 2:02 am

What Passmark said. Typically copying files onto an external drive from a Windows machine will mean brand new created dates and times for the files copied whereas Macs tend to keep the original created dates and times when files are copied. But as always there are lots of ifs and buts, if you want to rely upon whatever you are trying to prove, you'll need to test it.  

redcat
Senior Member
 
 
  

Re: Copying files to external drives on Mac Vs Windows

Post Posted: Wed May 16, 2018 5:08 am

I think I've read a thread about this before, but I can't find it now. The informations from this link help a lot to know the reality regarding file times in Windows 10:

cyberforensicator.com/...ime-rules/

Thanks to Oleg Skulkin and Igor Mikhaylov for their tests and conclusions!

If somebody got anything similar for Macs, feel free to post it, that would also be very useful.
_________________
Limited Privnet offer: get 10% discount on every Belkasoft, Compelson, Oxygen Forensics and Passware orders or renewals: privnet.biz/shop/ 

passcodeunlock
Senior Member
 
 

Page 1 of 1