Forums
Main Category
General (Technical,...
Copying file on Win...
 
Notifications
Clear all

Copying file on Windows Vs Mac

 
General (Technical, Procedural, Software, Hardware etc.)
6 Posts
3 Users
0 Reactions
1,047 Views
RSS
 wotsits
(@wotsits)
Reputable Member
Joined: 10 years ago
Posts: 253
Topic starter 13/08/2017 9:25 am  

When you copy files on Windows the metadata is changed, and if you want to preserve created and modification timestamps you have to use something like RichCopy.

However in Mac are my results correct that all the metadata timestamps are preserved when copying files between devices?


   
Quote
 mscotgrove
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
13/08/2017 5:14 pm  

If you copy a file in windows, the Modify date is not changed.

If you copy a file in windows to a new physical drive, the Create date is changed.

If you move a file in Windows to the same drive, dates are not changed.


   
ReplyQuote
 wotsits
(@wotsits)
Reputable Member
Joined: 10 years ago
Posts: 253
Topic starter 13/08/2017 10:49 pm  

If you copy a file in windows, the Modify date is not changed.

If you copy a file in windows to a new physical drive, the Create date is changed.

If you move a file in Windows to the same drive, dates are not changed.

Correct. Now what I am trying to confirm is when you copy from Mac to an external drive the create date remains unchanged - is this correct? And does it only apply to files not folders?


   
ReplyQuote
 mobileforensicswales
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
14/08/2017 8:12 pm  

https://forensic4cast.com/2016/10/macos-file-movements/


   
ReplyQuote
 wotsits
(@wotsits)
Reputable Member
Joined: 10 years ago
Posts: 253
Topic starter 17/08/2017 1:40 pm  

https://forensic4cast.com/2016/10/macos-file-movements/

This was brilliant! Any equivalent for NTFS format?


   
ReplyQuote
 mobileforensicswales
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
17/08/2017 3:21 pm  

Look at the top right chart first page of the forensic analysis poster

https://www.sans.org/security-resources/posters/


   
ReplyQuote
Forum Jump:
  Previous Topic
Next Topic  
Share: