±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 32607
New Yesterday: 2 Visitors: 99

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Copying file on Windows Vs Mac

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Copying file on Windows Vs Mac

Post Posted: Sun Aug 13, 2017 2:25 am

When you copy files on Windows the metadata is changed, and if you want to preserve created and modification timestamps you have to use something like RichCopy.

However in Mac are my results correct that all the metadata timestamps are preserved when copying files between devices?  

wotsits
Senior Member
 
 
  

Re: Copying file on Windows Vs Mac

Post Posted: Sun Aug 13, 2017 10:14 am

If you copy a file in windows, the Modify date is not changed.

If you copy a file in windows to a new physical drive, the Create date is changed.

If you move a file in Windows to the same drive, dates are not changed.
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 

mscotgrove
Senior Member
 
 
  

Re: Copying file on Windows Vs Mac

Post Posted: Sun Aug 13, 2017 3:49 pm

- mscotgrove
If you copy a file in windows, the Modify date is not changed.

If you copy a file in windows to a new physical drive, the Create date is changed.

If you move a file in Windows to the same drive, dates are not changed.


Correct. Now what I am trying to confirm is when you copy from Mac to an external drive the create date remains unchanged - is this correct? And does it only apply to files not folders?  

wotsits
Senior Member
 
 
  

Re: Copying file on Windows Vs Mac

Post Posted: Mon Aug 14, 2017 1:12 pm


mobileforensicswales
Senior Member
 
 
  

Re: Copying file on Windows Vs Mac

Post Posted: Thu Aug 17, 2017 6:40 am

- mobileforensicswales
https://forensic4cast.com/2016/10/macos-file-movements/


This was brilliant! Any equivalent for NTFS format?  

wotsits
Senior Member
 
 
  

Re: Copying file on Windows Vs Mac

Post Posted: Thu Aug 17, 2017 8:21 am

Look at the top right chart first page of the forensic analysis poster

www.sans.org/security-...s/posters/  

mobileforensicswales
Senior Member
 
 

Reply to topicReply to topic

Share and Like this forum topic to get more replies




Page 1 of 1